Overview

overview

10

Static

static

7

anyunlock-...1).exe

windows10-1703-x64

10

$PLUGINSDI...Vs.dll

windows10-1703-x64

3

$PLUGINSDI...ls.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...up.exe

windows10-1703-x64

7

$PLUGINSDI...ec.dll

windows10-1703-x64

3

$PLUGINSDI...ss.dll

windows10-1703-x64

3

$PLUGINSDIR/setup.exe

windows10-1703-x64

1

$PLUGINSDI...ll.exe

windows10-1703-x64

7

$PLUGINSDI...er.dll

windows10-1703-x64

3

$PLUGINSDI...Vs.dll

windows10-1703-x64

3

$PLUGINSDI...ib.dll

windows10-1703-x64

3

$PLUGINSDI...el.dll

windows10-1703-x64

7

$PLUGINSDI...tn.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...gs.dll

windows10-1703-x64

3

$PLUGINSDI...ss.dll

windows10-1703-x64

3

$PLUGINSDI...ry.dll

windows10-1703-x64

3

$PLUGINSDIR/un.exe

windows10-1703-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    anyunlock-iphone-password-unlocker-en-official-setup (1).exe
  • Size 14.1MB
  • Sample240502-jam1tacc61
  • SHA256 7d5b1d29a694e8fc136a5a13fd17b8c30d08c8d4f4d5d8006a5361d53acdf9de
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target
      anyunlock-iphone-password-unlocker-en-official-setup (1).exe
    • Size 14.1MB
    • SHA256 7d5b1d29a694e8fc136a5a13fd17b8c30d08c8d4f4d5d8006a5361d53acdf9de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1
    • Target
      $PLUGINSDIR/CheckProVs.dll
    • Size 7KB
    • SHA256 ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral2
    • Target
      $PLUGINSDIR/SkinnedControls.dll
    • Size 77KB
    • SHA256 5f7998711ea856730139c4dac403f11b947ed94a464dc6d2d4b22f928c3a8536
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral4
    • Target
      $PLUGINSDIR/dotNetFx45_Full_setup.exe
    • Size 982KB
    • SHA256 e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral6
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7
    • Target
      $PLUGINSDIR/setup.exe
    • Size 3.3MB
    • SHA256 9140755badab25fcca359fe83f74a4a435ec6136302ddafb489a90f563ad4157
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      $PLUGINSDIR/uninstall.exe
    • Size 11.2MB
    • SHA256 ea88d6f7e328e86762b4d586390bdc6eccca1501a3a03150968884e8cc3ad5dc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral9
    • Target
      $PLUGINSDIR/BgWorker.dll
    • Size 2KB
    • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10
    • Target
      $PLUGINSDIR/CheckProVs.dll
    • Size 7KB
    • SHA256 ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11
    • Target
      $PLUGINSDIR/GoogleTracingLib.dll
    • Size 36KB
    • SHA256 ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral12
    • Target
      $PLUGINSDIR/SelfDel.dll
    • Size 5KB
    • SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13
    • Target
      $PLUGINSDIR/SkinBtn.dll
    • Size 4KB
    • SHA256 e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral14
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral16
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17
    • Target
      $PLUGINSDIR/registry.dll
    • Size 24KB
    • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral18
    • Target
      $PLUGINSDIR/un.exe
    • Size 11.7MB
    • SHA256 ee8c4d17e67236e84faa12696aed1b4a8d5b529b73adc2a6b2787e26e96d191c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19

MITRE ATT&CK Enterprise v15

Tasks