Analysis
-
max time kernel
135s -
max time network
318s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-es -
resource tags
-
submitted
12-02-2024 01:21
General
-
Target
UnlockTool-2024-09-01-0.exe
-
Size
182.5MB
-
MD5
d47143627ffdbbc4a487b6cf0832d9ae
-
SHA1
652174cacdc5e773085061be52ce6783c81bec57
-
SHA256
543b67bea0d897b65be998ccd2b0cc58579c21f249b94b9c7cdcfbfe9283de8f
-
SHA512
c03b91257c3a212375ebd40670d199bdb33235e81a6146e062f0805c7165b3a3faa0e7554eb2599d8e5b5796f2b2a17ebfe809647e8be992a660ef3edf9f8497
-
SSDEEP
3145728:bYMQFgo7i9qCKLKaPbYL3LUDpRuU24HGWmV+iB2x5MlX7GOzbm7sweWJlY20CeTJ:V6go7i9BtaDYL3Q/92FWm3XHH4sPWJCX
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UnlockTool-2024-09-01-0.exe"C:\Users\Admin\AppData\Local\Temp\UnlockTool-2024-09-01-0.exe"1⤵
- Manipulates Digital Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD51a534450750eca1f3d951def8d9965bf
SHA17dd82b6d52a840c4979a7515fc7a9ca3725363c4
SHA2565e84d13636fbce7869cddc8b20c7d83fa0063e98c319e8e5ab751edc9ee1da76
SHA5123acdfff24a4d9ebb4e9647afccf95f33b4580980fb35a91eff65a01ce470b0bbc1a3a27c476653911f1fa431757ca64c945da89da54bffa599744f29123ef715
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB