Automated Malware Analysis IOC Report for

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;3082, Number of Pages: 200, Revision Number: {2E6A8679-AA0E-4E53-8E83-4BC40E86E325}, Title: Legalia 2, Author: CORPME, Number of Words: 2, Last Saved Time/Date: Tue Mar 21 15:30:04 2023, Last Printed: Tue Mar 21 15:30:04 2023
Entropy:	7.888165922882174
Filename:	Legalia2Setup.msi
Filesize:	7300096
MD5:	0a216a9077bd6cfc068733f066135328
SHA1:	3dfcd675381a7669d1d9ddbb075277f54c7abf3f
SHA256:	f2077ee5d8d323fcae3e098a94e893891fd086bf0cc82234669259a00a7d077b
SHA512:	fc3d25752b54c5b9df52117d2a64c309dd30b98464138f126eae96362224029e76405dcd0dcacffbfef3ccf26e98783a981b2763410b0c7a800b33121c2b42a0
SSDEEP:	98304:ioYic5MkgxLaYxCnTbLmbIExN+Pzt2iRZGHH/vJVXMo/uar0wi1YbdierPY7Hpxx:eiqMkgxLt0bN8EpCp/t0bYbd57GFrPX
Preview:	........................>...................p...............8...................]...^...F...G...H...I...J.......B.......w...x...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y..

Signature Hits	Behavior Group	Mitre Attack
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Config.Msi\610ce9.rbs
Category:	dropped
Dump:	610ce9.rbs.1.dr
ID:	dr_30
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	6.6452692952596415
Encrypted:	false
Size:	124889
Whitelisted:	false

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Ayuda\Legalia2HLPes.pdf
Category:	dropped
Dump:	Legalia2HLPes.pdf.1.dr
ID:	dr_18
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PDF document, version 1.4, 10 pages
Entropy:	7.907316835486357
Encrypted:	false
Size:	330998
Whitelisted:	false

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\CORPME.SECURITY.dll
Category:	dropped
Dump:	CORPME.SECURITY.dll.1.dr
ID:	dr_17
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.848686377964937
Encrypted:	false
Size:	375296
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\CORPMEeFirma.dll
Category:	dropped
Dump:	CORPMEeFirma.dll.1.dr
ID:	dr_10
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.766894845777168
Encrypted:	false
Size:	166912
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\CorpmeeFE.dll
Category:	dropped
Dump:	CorpmeeFE.dll.1.dr
ID:	dr_6
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.09603559426898
Encrypted:	false
Size:	2971136
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\ICSharpCode.SharpZipLib.dll
Category:	dropped
Dump:	ICSharpCode.SharpZipLib.dll.1.dr
ID:	dr_11
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.683688089372797
Encrypted:	false
Size:	200704
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\IconoColegio.ico
Category:	dropped
Dump:	IconoColegio.ico.1.dr
ID:	dr_24
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
Entropy:	2.2945981505892985
Encrypted:	false
Size:	67646
Whitelisted:	false

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Legalia2.exe
Category:	dropped
Dump:	Legalia2.exe.1.dr
ID:	dr_25
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.001706691914569
Encrypted:	false
Size:	4716544
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Drops PE files	Persistence and Installation Behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Security Software Discovery Windows Management Instrumentation Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries process information (via WMI, Win32_Process)	System Summary	System Information Discovery Windows Management Instrumentation
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary	System Information Discovery
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Uses Microsoft Silverlight	System Summary

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Legalia2.exe.config
Category:	dropped
Dump:	Legalia2.exe.config.1.dr
ID:	dr_21
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.325572247408468
Encrypted:	false
Size:	514
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Security Software Discovery Windows Management Instrumentation Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries process information (via WMI, Win32_Process)	System Summary	System Information Discovery Windows Management Instrumentation
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary	System Information Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Uses Microsoft Silverlight	System Summary

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Legalia2Installer.InstallState
Category:	dropped
Dump:	Legalia2Installer.InstallState.7.dr
ID:	dr_33
Target ID:	7
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2594), with no line terminators
Entropy:	5.179903998694314
Encrypted:	false
Size:	2597
Whitelisted:	false

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Legalia2Installer.dll
Category:	dropped
Dump:	Legalia2Installer.dll.1.dr
ID:	dr_9
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	4.986832909689194
Encrypted:	false
Size:	9216
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Microsoft.ReportViewer.Common.dll
Category:	dropped
Dump:	Microsoft.ReportViewer.Common.dll.1.dr
ID:	dr_12
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.141004336077301
Encrypted:	false
Size:	6388088
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Microsoft.ReportViewer.ProcessingObjectModel.dll
Category:	dropped
Dump:	Microsoft.ReportViewer.ProcessingObjectModel.dll.1.dr
ID:	dr_19
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.0358055472578105
Encrypted:	false
Size:	92056
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\Microsoft.ReportViewer.WinForms.dll
Category:	dropped
Dump:	Microsoft.ReportViewer.WinForms.dll.1.dr
ID:	dr_8
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.997973225762315
Encrypted:	false
Size:	546688
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\NLog.dll
Category:	dropped
Dump:	NLog.dll.1.dr
ID:	dr_22
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.955176127490977
Encrypted:	false
Size:	612352
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\System.IO.Compression.dll
Category:	dropped
Dump:	System.IO.Compression.dll.1.dr
ID:	dr_7
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.4369283052543125
Encrypted:	false
Size:	66888
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\System.Net.Http.dll
Category:	dropped
Dump:	System.Net.Http.dll.1.dr
ID:	dr_13
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.05230026111273
Encrypted:	false
Size:	83136
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\CORPME\Legalia 2\itextsharp.dll
Category:	dropped
Dump:	itextsharp.dll.1.dr
ID:	dr_23
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.044591962411611
Encrypted:	false
Size:	3694592
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Legalia 2.lnk
Category:	dropped
Dump:	Legalia 2.lnk.1.dr
ID:	dr_27
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Entropy:	2.638408800535573
Encrypted:	false
Size:	2623
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\Public\Desktop\Legalia 2.lnk
Category:	dropped
Dump:	Legalia 2.lnk0.1.dr
ID:	dr_28
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Entropy:	2.628693402132069
Encrypted:	false
Size:	2611
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Details

File:	C:\Users\user\.Legalia2\ConfLegalia2.xml
Category:	dropped
Dump:	ConfLegalia2.xml0.17.dr
ID:	dr_35
Target ID:	17
Process:	C:\Program Files (x86)\CORPME\Legalia 2\Legalia2.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.971310831073418
Encrypted:	false
Size:	1592
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\CFGDFED.tmp
Category:	dropped
Dump:	CFGDFED.tmp.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Windows\SysWOW64\msiexec.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.038757123363281
Encrypted:	false
Size:	152
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDFEE.tmp
Category:	dropped
Dump:	MSIDFEE.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.504247783181216
Encrypted:	false
Size:	305152
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Fonts\code128.ttf
Category:	dropped
Dump:	code128.ttf.1.dr
ID:	dr_20
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	TrueType Font data, 11 tables, 1st "OS/2", 16 names, Macintosh, Grandzebu. 2003. All Rights Reserved - GNU General Public LicenseRegularCode 128:1,201,20 Januar
Entropy:	4.497206670622352
Encrypted:	false
Size:	7884
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Windows\Installer\610ce8.msi
Category:	dropped
Dump:	610ce8.msi.1.dr
ID:	dr_14
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;3082, Number of Pages: 200, Revision Number: {2E6A8679-AA0E-4E53-8E83-4BC40E86E325}, Title: Legalia 2, Author: CORPME, Number of Words: 2, Last Saved Time/Date: Tue Mar 21 15:30:04 2023, Last Printed: Tue Mar 21 15:30:04 2023
Entropy:	7.888165922882174
Encrypted:	false
Size:	7300096
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSI1140.tmp
Category:	dropped
Dump:	MSI1140.tmp.1.dr
ID:	dr_16
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.256438373419202
Encrypted:	false
Size:	433472
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSI1567.tmp
Category:	dropped
Dump:	MSI1567.tmp.1.dr
ID:	dr_29
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.596202706431375
Encrypted:	false
Size:	109472
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\Installer\SourceHash{9B3E90BC-1D57-4017-8333-35E8FDAEDF7F}
Category:	dropped
Dump:	SourceHash{9B3E90BC-1D57-4017-8333-35E8FDAEDF7F}.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.165312158827701
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\{9B3E90BC-1D57-4017-8333-35E8FDAEDF7F}\_DB919AB071B372378E83C6.exe
Category:	dropped
Dump:	_DB919AB071B372378E83C6.exe.1.dr
ID:	dr_26
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
Entropy:	2.2944749596283254
Encrypted:	false
Size:	67646
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.1.dr
ID:	dr_15
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.356154854546596
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF047C0385DEC1F9A9.TMP
Category:	dropped
Dump:	~DF047C0385DEC1F9A9.TMP.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.1983582915415147
Encrypted:	false
Size:	69632
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF6AB44113BFF427A8.TMP
Category:	modified
Dump:	~DF6AB44113BFF427A8.TMP.1.dr
ID:	dr_32
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFC5F44B05F4FE42D3.TMP
Category:	dropped
Dump:	~DFC5F44B05F4FE42D3.TMP.1.dr
ID:	dr_5
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.7005377544754858
Encrypted:	false
Size:	20480
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFC8826386CB0E8AD3.TMP
Category:	dropped
Dump:	~DFC8826386CB0E8AD3.TMP.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.07264902631307761
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DFCEEEDA8442420AAF.TMP
Category:	dropped
Dump:	~DFCEEEDA8442420AAF.TMP.1.dr
ID:	dr_31
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.3517944755506481
Encrypted:	false
Size:	32768
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Legalia2Setup.msi

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportLegalia2Setup.msi

Files

Domains

IPs

IOC Report
Legalia2Setup.msi