Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3EA DLC Unlocker v2.7z
windows10-2004-x64
7EA DLC Unl...ig.ini
windows10-2004-x64
1EA DLC Unl...on.dll
windows10-2004-x64
1EA DLC Unl...es.ini
windows10-2004-x64
1EA DLC Unl...23.ini
windows10-2004-x64
1EA DLC Unl... 3.ini
windows10-2004-x64
1EA DLC Unl...22.ini
windows10-2004-x64
1EA DLC Unl...23.ini
windows10-2004-x64
1EA DLC Unl...nk.ini
windows10-2004-x64
1EA DLC Unl...ds.ini
windows10-2004-x64
1EA DLC Unl...wo.ini
windows10-2004-x64
1EA DLC Unl...ro.ini
windows10-2004-x64
1EA DLC Unl...ia.ini
windows10-2004-x64
1EA DLC Unl...at.ini
windows10-2004-x64
1EA DLC Unl...ed.ini
windows10-2004-x64
1EA DLC Unl...ck.ini
windows10-2004-x64
1EA DLC Unl...nd.ini
windows10-2004-x64
1EA DLC Unl...rd.ini
windows10-2004-x64
1EA DLC Unl...er.ini
windows10-2004-x64
1EA DLC Unl...or.ini
windows10-2004-x64
1EA DLC Unl...13.ini
windows10-2004-x64
1EA DLC Unl... 3.ini
windows10-2004-x64
1EA DLC Unl... 4.ini
windows10-2004-x64
1EA DLC Unl...ty.ini
windows10-2004-x64
1EA DLC Unl...ge.ini
windows10-2004-x64
1EA DLC Unl...ne.ini
windows10-2004-x64
1EA DLC Unl... 6.ini
windows10-2004-x64
1EA DLC Unl...on.dll
windows10-2004-x64
1EA DLC Unl...me.txt
windows10-2004-x64
1EA DLC Unl...up.bat
windows10-2004-x64
1EA DLC Unl...nux.sh
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
EA DLC Unlocker v2.7z
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
EA DLC Unlocker v2/config.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
EA DLC Unlocker v2/ea_desktop/version.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
EA DLC Unlocker v2/g_Cities Skylines.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
EA DLC Unlocker v2/g_Dead Space 2023.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
EA DLC Unlocker v2/g_Dead Space 3.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
EA DLC Unlocker v2/g_F1 22.ini
Resource
win10v2004-20231222-en
Behavioral task
behavioral8
Sample
EA DLC Unlocker v2/g_F1 23.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
EA DLC Unlocker v2/g_Frostpunk.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
EA DLC Unlocker v2/g_GRID Legends.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
EA DLC Unlocker v2/g_It Takes Two.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
EA DLC Unlocker v2/g_Mutant Year Zero.ini
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
EA DLC Unlocker v2/g_My Time at Portia.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
EA DLC Unlocker v2/g_Need For Speed Heat.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
EA DLC Unlocker v2/g_Need For Speed Most Wanted.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
EA DLC Unlocker v2/g_Need For Speed Payback.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
EA DLC Unlocker v2/g_Need For Speed Unbound.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
EA DLC Unlocker v2/g_Northgard.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
EA DLC Unlocker v2/g_STAR WARS Jedi Fallen Order.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
EA DLC Unlocker v2/g_STAR WARS Jedi Survivor.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
EA DLC Unlocker v2/g_SimCity 2013.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral22
Sample
EA DLC Unlocker v2/g_The Sims 3.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
EA DLC Unlocker v2/g_The Sims 4.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral24
Sample
EA DLC Unlocker v2/g_The Sinking City.ini
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
EA DLC Unlocker v2/g_The Surge.ini
Resource
win10v2004-20231222-en
Behavioral task
behavioral26
Sample
EA DLC Unlocker v2/g_This War of Mine.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
EA DLC Unlocker v2/g_Tropico 6.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral28
Sample
EA DLC Unlocker v2/origin/version.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
EA DLC Unlocker v2/readme.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral30
Sample
EA DLC Unlocker v2/setup.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
EA DLC Unlocker v2/setup_linux.sh
Resource
win10v2004-20231215-en
General
-
Target
EA DLC Unlocker v2.7z
-
Size
181KB
-
MD5
41de363c713ee4a1bb04e7a5d8d2a6c2
-
SHA1
15520a1c62ddff061d0ae810270b7170895e2a89
-
SHA256
76abf90f3575a023b53226ad1e4a3fe46eb409450a99ad97e53eed1912ade9cc
-
SHA512
57a821eeaf9b01208dbe2a2976f64a2615ef33e4d23cba58a0f53192a01b9255035e23687f8246ad34b85654042c5643bbd3f6ad58d62fb0e70afbe31f9a7b1a
-
SSDEEP
3072:+tyNScvIh5BFH7q+ESI0TjL5PR5GYoxH/GtbU0zy7MUmUu7KwbJ/6RRSxm47j5:25Lvu+DvtP/oxH/MNy7zmFhJ/6RRwR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3792 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3792 7zFM.exe Token: 35 3792 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3792 7zFM.exe 3792 7zFM.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3792 3264 cmd.exe 88 PID 3264 wrote to memory of 3792 3264 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2.7z"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3792
-