Analysis
-
max time kernel
150s -
max time network
167s -
platform
windows10-1703_x64 -
resource
win10-20231025-en -
resource tags
-
submitted
12-11-2023 03:17
General
-
Target
UnlockTool-2023-11-10-0.exe
-
Size
171.9MB
-
MD5
3eccb8c74f961b6c8c28bd1359588ead
-
SHA1
82ef5500722cd9b9e45f2ac0c8a180067e2556ad
-
SHA256
c045bddb539997cf70bece9be31a2948f23bd1248f1d14e4f186ad2ec176a8a3
-
SHA512
8662eb1660b807755f960755655c85da321f5684f6e42f990db4b2282ba1d8aab7b37d151d66b8a64e6bf730a8867487904cd511b45e02649b37027d72acc6bd
-
SSDEEP
3145728:FjlpipTp3bcwUSG/P/15mF+Lpj1UhRvge1YYgJ53Q2YFUg4JCmlDk:9ipVoh1fpmhRvgCYNJZYFV4Jl4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 8 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UnlockTool-2023-11-10-0.exe"C:\Users\Admin\AppData\Local\Temp\UnlockTool-2023-11-10-0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UnlockTool-2023-11-10-0.exe"C:\Users\Admin\AppData\Local\Temp\UnlockTool-2023-11-10-0.exe" -update2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5edf30471590878a295c571f919fea228
SHA119133beaf41608a7992fdd9bdbdec4bd7ded47cf
SHA256a00476b455b297303bfce81d1ed5ae84302adbe6db8694f2d715bafd33941a70
SHA512732f6ee2740585089baa563848c84723eac7bbd0838c8a8d9f35a849965bdbbd53bb2517340d576cc9d4d6079c61b72a99d65014920d6ba98d07ab5a0d2ceb79
-
Filesize
2.8MB
MD51c66d55f3f3b4273f5439ffaa7614fec
SHA1a7dd7d4925602d44351a87d7e6582a0ae168db25
SHA256c98f3f279b01d565b936ceb71e68e6f55a163108e0f4ace244dfebf8e88875b0
SHA5128b5a48bdd5c4e997630380ed8d8ba1f2791a44ee468ebf597ce81b6428fbaacfb3920a8fd43b3b589c8969e096de392f09b1394a1fc15a4db80c45eb869b51d6
-
Filesize
4.8MB
MD58bd6e01b7f27c473ab95c1fc9f52e608
SHA17876fef9410f5abf0fdd0c33fd9611de8d35e5a4
SHA25630f78dbe6c03cc039b131e066629b4b6f0166da09aca9f4cc1b01113fe3a055c
SHA512f4a7160a6211eedffebf8d76c2e08116e65b8a85ba21a2a47d666a08d5fb8cb03f6f0e080be5b3ca56d1aa303e9a537186896980c237a2131cd9ffb57ebb34a9
-
Filesize
55KB
MD52c88fa9f9dcac61c29b77307db771265
SHA164211dfa3d4db4248e3632480865bde0217d8924
SHA256c60f58248c6e8cc81f7f6fb257ed798fe7d3f70c483a117b54cbef3e4ae82d5e
SHA51285f794d4a1d61d04385f9c9a502095923c2b2219241d757ced5227e3b0ef33777fa290ab155836ef2d980adedd4a680e3b6561f5c8ab5b32bc1bc5627f605f11
-
Filesize
641KB
MD5fc4a757e1eeb044fda34096fb1a98b23
SHA12a212de14c28a38335d6545623084eee0154f784
SHA256916d0425b4315855849e8954c654edd730acc76ae92ecbece3422f33f3c92d2d
SHA5120b6e9c729ee16ba00733a9902b19af0e0c6879a87f9d4dd3ecf46f425ad05ff7a5018063f3015fd7b185fdaa8868678188f2efdf8634226ea299710629e2ebd3
-
Filesize
18KB
MD5a1162f8837d4b951b37bd2f8dd2e2158
SHA11257c54e21eb9836baad6cd4292d5f81a52114db
SHA2568c68c5cd991cd349d98a29c451a305f7cf16da52a920bcc9037c1bdf30bfcb6e
SHA51233f3139ac87a1be8fd872871ea8e555f1573c134a5c464d0573c6c0eb871a979b8804d742f4db2386ce9552738148342a96db73fd56786a4b5a62463f7a58299
-
Filesize
130KB
MD5b462e95a3b00f3217858b73575aef814
SHA15a4eaa547e13c60f355e00626380937343d60787
SHA256655090fa89db9a0934a104ea4a36fe92a6f81ced06a9d13d9afcfb66f2de52ea
SHA512febac6027c0118d1006785fad4d4acbad8ffe8b87e7625b37b1c8bae29d3705ef974beecedfd86e7d3a71bf74349c3626c372db6de13d6a8d7f2d9d7a3bcbf26
-
Filesize
2KB
MD57fb7b21b5e48b362d549502f69a5df7a
SHA1a8d011b79b028376a5924fcc0a3add4dc12bc9e5
SHA256a1b54d3fdb5e4ee0619d362356164e0d727a4ac2498ce964861f83bfd843ad2e
SHA5128b6f59575f28acfa6eeccd31f1482eab8de2f0f833f8896e6496d8bb7a72b09d32e3025c75f03dd959e5fbbf6743bc8851df5415024cfefd03b2f9e9541485da
-
Filesize
2KB
MD57fb7b21b5e48b362d549502f69a5df7a
SHA1a8d011b79b028376a5924fcc0a3add4dc12bc9e5
SHA256a1b54d3fdb5e4ee0619d362356164e0d727a4ac2498ce964861f83bfd843ad2e
SHA5128b6f59575f28acfa6eeccd31f1482eab8de2f0f833f8896e6496d8bb7a72b09d32e3025c75f03dd959e5fbbf6743bc8851df5415024cfefd03b2f9e9541485da
-
Filesize
610KB
MD57f8b33f217ab3c33ad036e23b9a4e1b2
SHA18c4b5cfa104e8d9bef6a0f737b63359c5d846074
SHA2566eae2fadc06f7078874a773d002d128ee1163db8dd0e9ea0e96076b13f9c584e
SHA5125ea7896c834bd43901dfff16003b00f6bb11ed481fa7f87c07592b34e646e455f787d3f1d66743af0be4afb8703c6a40cbfa4c53029f3617cab2256022d93fb4
-
Filesize
7.6MB
MD552bf7c592f826cde7a522c0e2c2801da
SHA128467bac5752c2e06f34e1d4537d0eefdb42bc22
SHA256f047c9f50c110311eebf81d5c85dc71ad678547153065958f2288640b819fed9
SHA512e91988a8558a7ef0539bbdcbaaddd09f7c84b70cfcbc5f9f3841cd91bbb54c82248ea52c285d10bb77d1a401bd9ff2549126c59b1d452f3d8aa8b206cabe4a7f
-
Filesize
4.9MB
MD547299b0f5a20a3f5c3206fcb9f8a5056
SHA11c9c4ae69a0bd5a84f0b251a1588b72a24ff86f3
SHA256912c78f18bb2731ff601321ad2157897bbddac8b55084ffde16f090d4d18ff5a
SHA5121f6c5bf17072fec3d274ac3c920a172d2566c3087aad140acdadc9628df64fe9acd58edf6f36a50ea98636e62b472bf6d6a562583cebcb38278cdcb45acbc845
-
Filesize
1.8MB
MD5863669de91690c59cb268eadc6837def
SHA1cc61cf3802080e698884970d8e316f424b2972fe
SHA256669622f26bf36a6f7c034e1ea2164c5083b3026a48c555384ac11182c0445fa6
SHA512b7a47f9e937994516add1fe4e29d9324fd6edde86f0f0ae4ecdcc64bd18d127eeeed39f3b56c93745158d869e6355ebcbbad96a9120603b6f9a46f16fc5517d4
-
Filesize
5.2MB
MD58812b3674fae2d85f1bce1120f7bfceb
SHA15787fd9106ebe5b87d87d3516450d907b6c29952
SHA25683159e127f8d56305f3b08a6b18db56aafe564457f8abfbd6a42892d77b5de47
SHA512a69afb033c9338431acaa04d18de693da2b6415bbb12aecde01d91f7460c89bd7e44e1eff5910391c892ffc4b29c7701cc3681e53512f875dede51f05b1d6afe
-
Filesize
7KB
MD5a961c106d4eaf0bc30d0554b8a0e51c8
SHA1fdd6d59a97f96ed9b237de7950ed77d9c4deeab7
SHA2560aeb78a0f3b514e5afea7839f6016c228de8ac693aeff8cbaca9ff411f524936
SHA5127e389530fd598a676749cfc353c78f51636081d439657f5f9364e0bd3101b18b01f17887f2d8270aef62bbcb3fa0c1cb259241b12ad747dc29230a49977d18e5
-
Filesize
8KB
MD546189a953ae68087974c7aba24a6ec0f
SHA18d4e4c588cce8d76221647d7d9b53e5043876dc6
SHA2567a416587bd484d004b09730d8fe577a3f20d98412851310b2ae8f15c97db55ae
SHA5129ec44c702a2de7bb7f60d6caf389b0940bd80fb9499e99ab96f82f38258c9a4f4bc4d0425b95194d965a33aa5238e3e554e70d63704266c6b72b8416efebf469
-
Filesize
74KB
MD51d8215f7f8cd02a553499b534ccfb4d5
SHA1bab236f840f1521c43bcbaa2a7b92f14f329bc70
SHA2564f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14
SHA51279ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69
-
Filesize
51KB
MD516e18ced459b1824234890386ee66cd5
SHA181d2b572ec0d24aba11ed6bfa9174ffad54140b7
SHA2568058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989
SHA512b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98
-
Filesize
45KB
MD51a534450750eca1f3d951def8d9965bf
SHA17dd82b6d52a840c4979a7515fc7a9ca3725363c4
SHA2565e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
SHA5123acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
-
Filesize
98KB
MD51604ddcdaed9e447f6729ad1689e5630
SHA1a9ff1af89dc327fa7da5cf949610fe5fb4893320
SHA2560690cd87d0069edac3a867e0b51f379afa77159eda3b45cd02740fc6afb546d8
SHA512e12d695e672d05e706e6d8a12aa75b4aba0325ea01a47679553317c27e8dabaa643ef866ecf165c504d5855310afc479c1c4f587ba126ab1337b74d27fd1a279
-
Filesize
46KB
MD5a814ff2972f55909aaffd943ebb0e866
SHA1b966ad29d209c64b3f0d879703086df1f6121e6b
SHA2561df66ff22e2eaec27180756d90926ca5b07e8bcf6b0e4e3c56471e63a3a05fa6
SHA51237f2fe6ae0160d67709b125ff3edcc894effffd377e0086072aa96e53a5191fd67988f2a5465d24c87b41e9ed20f8ae30da18c216a568c7bcac6328ca2ec01b8
-
Filesize
82KB
MD5bd03c4792f08f0c889441f49df9deb98
SHA1157c8395159678a02fe55c1f60683b7d0f8e2a38
SHA256e908fb5501d74f810948cacbe476658479f19f4d2aff14f9044f18981be9c6fc
SHA512d8683012112ff9486eef436080f31469ef37be97ba12785d5b23c8f3190800645357436777b8b14da5af5c2342ec0aea6b47ba108d85f0fe3f2719e69d2fe90b
-
Filesize
45KB
MD51a534450750eca1f3d951def8d9965bf
SHA17dd82b6d52a840c4979a7515fc7a9ca3725363c4
SHA2565e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
SHA5123acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
-
Filesize
7.1MB
MD5285ff5793e700f701043a060bcf8a24d
SHA1b218c9c464d46891fa3c3fea2c27b9732a878702
SHA2565a6c5535e014af12ee11a31d7d4d60b6fc6a5adb947867d7153ea398e247b76f
SHA5121d5f5618565dee5ed8322771c524d6161a33850699631d72a3e59fafda19b66a272f8735ae30428fd1d9278ab5f76519100d2ba91f3bc6d3089f901ee7994e5a
-
Filesize
6KB
MD5e8b579968e3ddf68c77873509bef607c
SHA1d6e941b6dedc624ad157d6e96403bb02a82b5933
SHA256a472673ea219f2173da3565495e16c04ac32be3b87b8618b6be98aeb62bec5fc
SHA512db10659ee2c97143937e520a27ab821384056c76c84967e10721c8855a45f8434af5825b388efbbc7ed46ff58de3d1657c05b3db2891178f2894bdebb33aed90
-
Filesize
1KB
MD54cb7b202274486d00b480bf87fc8964b
SHA120a1af5e4cfcd51cdcc7a378fec07d3b1e88fcdc
SHA256822fdda9d40430e9a8b852ba920d6c1a2aaaf9530727d3e0a2c42afb4b86d011
SHA51252d1b6788647314bc2b46a785e6658e7b64cf41e9ad8cb2b4502ec5660ceac0a2e59401a498ecf8e4609b0909a7af016c1dd8a5dd0e4713891eabf1293a7a92a
-
Filesize
736B
MD53aa71a526c68d0d9ee9ebd07bc199342
SHA10e68fcf27c261eaa0f0de3053e2b3a5692f6ca2e
SHA256caefebb4a3d55a08bb935d63b475b9b43a331d9570f0abf158c139e772f22c7a
SHA5123a013ca9a64ad743dcd8959c660ea40cce1c234fa14737d800546be2554c5403206f7bf55665abd7f9cf69c681f300673d55e4b6abe469b79f26aba635e69703
-
Filesize
736B
MD53aa71a526c68d0d9ee9ebd07bc199342
SHA10e68fcf27c261eaa0f0de3053e2b3a5692f6ca2e
SHA256caefebb4a3d55a08bb935d63b475b9b43a331d9570f0abf158c139e772f22c7a
SHA5123a013ca9a64ad743dcd8959c660ea40cce1c234fa14737d800546be2554c5403206f7bf55665abd7f9cf69c681f300673d55e4b6abe469b79f26aba635e69703
-
Filesize
1KB
MD514b79e6969c5d5ea9d8c55018201c1f0
SHA1fbe11f6170659f4a3064d3159fe8ffce0ce06c67
SHA256e92d6a0eeaa70d8a62c65db2c21a34b04e6c8a7de4b8ec620c576a0dd230cd9c
SHA512c893ea070c2da2dcb971cb63e8854d94eaa848a1f71e2beaabdf63d229b7813f32791ecf175909243c4346562a3d6390ffd4ba51452243f72b83318c9e2c64d4
-
Filesize
1KB
MD514b79e6969c5d5ea9d8c55018201c1f0
SHA1fbe11f6170659f4a3064d3159fe8ffce0ce06c67
SHA256e92d6a0eeaa70d8a62c65db2c21a34b04e6c8a7de4b8ec620c576a0dd230cd9c
SHA512c893ea070c2da2dcb971cb63e8854d94eaa848a1f71e2beaabdf63d229b7813f32791ecf175909243c4346562a3d6390ffd4ba51452243f72b83318c9e2c64d4
-
Filesize
166.5MB
MD5bfad7a35f547a0ac94b2f11e422942f3
SHA1616145a37f7046ece857e00753a077496fb08d78
SHA256b5c7f60dfc34c934fe3d706f5f120eb28ab603eebe6ab9403704118203ec9db1
SHA512eb18fbdd89070930d6232893ba1cc76965384121423aeee4bbb7f620428ddee84eda317d168b6d800ec7a45743045f8db5b18fae1af938f458933a10c9ade505
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
976KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
976KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB