a213e0faf45cabad343b34a05a65ef437bed06fdf392a01a25b28def670a70e2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
anyunlock-iphone-password-unlocker-en-setup.exe
Size 18.1MB
Sample240402-zn2dcsdc51
SHA256 a213e0faf45cabad343b34a05a65ef437bed06fdf392a01a25b28def670a70e2
MD5 04878e205d6d7f7119648d8211380753
SHA1 0fa01236f73729a770aeb0e38aa242bea3708958
SHA512 8bf09c8e4eff88f7534cdebed5301c5c788a717a3807fa04a00dcd90b2d6ac0e1ff2a9bc747779aacb157451e575115829340905063de82ce46e650e58ea9887
SSDEEP 393216:4rd+epId4E2HRonQWJI+EOj/zVSOGNUUUIfNeleh/yPxmG:4rd44E2xPWJI+E0/zUO3oe4hKP3
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	anyunlock-iphone-password-unlocker-en-setup.exe

Loads dropped DLL 5 IoCs

pid	Process
4744	anyunlock-iphone-password-unlocker-en-setup.exe
4744	anyunlock-iphone-password-unlocker-en-setup.exe
4744	anyunlock-iphone-password-unlocker-en-setup.exe
4744	anyunlock-iphone-password-unlocker-en-setup.exe
4744	anyunlock-iphone-password-unlocker-en-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	anyunlock-iphone-password-unlocker-en-setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	anyunlock-iphone-password-unlocker-en-setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1944	4744	anyunlock-iphone-password-unlocker-en-setup.exe	86
PID 4744 wrote to memory of 1944	4744	anyunlock-iphone-password-unlocker-en-setup.exe	86
PID 4744 wrote to memory of 1944	4744	anyunlock-iphone-password-unlocker-en-setup.exe	86
PID 1944 wrote to memory of 3244	1944	cmd.exe	89
PID 1944 wrote to memory of 3244	1944	cmd.exe	89
PID 1944 wrote to memory of 3244	1944	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-setup.exe
"C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"613003D3\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"2.0.1.2\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=TQ-BdekiTo671_UiBfGprA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\curl.exe
    curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"613003D3\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"2.0.1.2\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=TQ-BdekiTo671_UiBfGprA"
    3⤵
    PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckProVs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4F69.tmp\CheckProVs.dll
Size 7KB
SHA256 ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
MD5 62e85098ce43cb3d5c422e49390b7071
SHA1 df6722f155ce2a1379eff53a9ad1611ddecbb3bf
SHA512 dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
SSDEEP 96:iqCVh8iNqVgRudZczLiJp2tvgaJOnT/323x3XQUPVAm6yBBECtu7ZyvN:9IhJqUudZkLi+bOni3x3X3PVR6yBBfj
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleTracingLib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4F69.tmp\GoogleTracingLib.dll
Size 36KB
SHA256 ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
MD5 d8fca35ff95fe00a7174177181f8bd13
SHA1 fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA512 eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
SSDEEP 768:IWXV2fVEC5h9KclMCumc6plPHY4jq7rOZkdhKZV:8Smh9/BumTlg4kOZ+Kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4F69.tmp\System.dll
Size 11KB
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDui.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4F69.tmp\nsDui.dll
Size 5.8MB
SHA256 b28363bd1075dbd2e94e5fa22943a98dacdd53a2fa42921c2885703554d9c586
MD5 2eb92cc54285af5f5693119080c60ed8
SHA1 b680f79ca6cc219ed877fa10437e77108ec7b7fd
SHA512 5c66d50e5c45392388b3490875f0604a5c05ef0591238c3544fd410883a8455c229f1a8cd147c26fb87f56ded56cce853261b06ff8454d433f39f51b3035a6ba
SSDEEP 98304:5mODfTz+xbDcc0Wc9dOJxYKmSAWjOcsyxKwOj0jRHKmSAW0OW4JXlVgFKzpxdBB7:gAOxhg9dOJBFFOjwOj3FmOXPV5prBBSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads