Overview
overview
10Static
static
7anyunlock-...1).exe
windows7-x64
10anyunlock-...1).exe
windows10-2004-x64
7$PLUGINSDI...Vs.dll
windows7-x64
3$PLUGINSDI...Vs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...up.exe
windows7-x64
7$PLUGINSDI...up.exe
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDIR/setup.exe
windows7-x64
1$PLUGINSDIR/setup.exe
windows10-2004-x64
1$PLUGINSDI...ll.exe
windows7-x64
7$PLUGINSDI...ll.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...Vs.dll
windows7-x64
3$PLUGINSDI...Vs.dll
windows10-2004-x64
3$PLUGINSDI...ib.dll
windows7-x64
1$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDI...tn.dll
windows7-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 07:03
Behavioral task
behavioral1
Sample
anyunlock-iphone-password-unlocker-en-official-setup (1).exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
anyunlock-iphone-password-unlocker-en-official-setup (1).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SkinnedControls.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SkinnedControls.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/setup.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/uninstall.exe
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/uninstall.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/uninstall.exe
-
Size
11.2MB
-
MD5
48d796c60981cce5be144c8ff52466f1
-
SHA1
83a4e3ecb47c14ba8eac80d4fa69ba53c07d4153
-
SHA256
ea88d6f7e328e86762b4d586390bdc6eccca1501a3a03150968884e8cc3ad5dc
-
SHA512
9476e27126fc3f7b0001c21d7b30035ee37a7d0576ea647f77bd5f9cff61d7c809cf67a8808bccab2b5ed3cdc8cfdabc906ee1c18b22c0b5dc79dd506243cc17
-
SSDEEP
196608:HhKgznK4UZ9oHpWSQQ+87W4DFPwV422RBhox+Ht+FPYLrvaDbP8+uDgCAoy:HhK4K4UZyHdN+8b/hGG+ByvaDzfxoy
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation uninstall.exe -
Executes dropped EXE 1 IoCs
pid Process 1720 un.exe -
Loads dropped DLL 9 IoCs
pid Process 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 uninstall.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier uninstall.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe 4504 uninstall.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1720 un.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4504 wrote to memory of 2240 4504 uninstall.exe 87 PID 4504 wrote to memory of 2240 4504 uninstall.exe 87 PID 4504 wrote to memory of 2240 4504 uninstall.exe 87 PID 2240 wrote to memory of 560 2240 cmd.exe 89 PID 2240 wrote to memory of 560 2240 cmd.exe 89 PID 2240 wrote to memory of 560 2240 cmd.exe 89 PID 4504 wrote to memory of 1720 4504 uninstall.exe 90 PID 4504 wrote to memory of 1720 4504 uninstall.exe 90 PID 4504 wrote to memory of 1720 4504 uninstall.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"D41FDBC3\",\"events\":[{\"name\":\"Uninstall_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-com-pp\",\"install_trackversion\":\"2.1.0.0\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=vT2-CR2mSpKugIO5e8H3pQ""2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"D41FDBC3\",\"events\":[{\"name\":\"Uninstall_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-com-pp\",\"install_trackversion\":\"2.1.0.0\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=vT2-CR2mSpKugIO5e8H3pQ"3⤵PID:560
-
-
-
C:\Users\Admin\AppData\Local\Temp\un.exe"C:\Users\Admin\AppData\Local\Temp\un.exe" """av:2.1.0" "gv:2.1.0.0" "gs:Official-com-pp" "gi:UA-85655135-16" "an:AnyUnlock - iPhone Password Unlocker" "c:iMobie"""2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD562e85098ce43cb3d5c422e49390b7071
SHA1df6722f155ce2a1379eff53a9ad1611ddecbb3bf
SHA256ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
SHA512dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
-
Filesize
36KB
MD5d8fca35ff95fe00a7174177181f8bd13
SHA1fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA256ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
SHA512eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
-
Filesize
11.7MB
MD5cbea93b5c3fc5080bb200c58edc14dd6
SHA14204117c82823c54dc5e3f05a4c1ff667fefb331
SHA256ee8c4d17e67236e84faa12696aed1b4a8d5b529b73adc2a6b2787e26e96d191c
SHA5122977e50a98ef9bb76f3f63a0909c6fbca0f08ceeb8d796c3c57364474736cb5d3a8803c32f6a6f7cc66c89129aead2e37c87369b96160bef6df6aff7a4171e8a