Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 01:18

General

  • Target

    unlocker1.9.0-x64.exe

  • Size

    1006KB

  • MD5

    07b3b4e4371402adf8a04c3267cdb0e5

  • SHA1

    c74b4f58dfa41a3d2b4cf70be2c8d773a84944f8

  • SHA256

    b6d751943834bca1e8841edcbe9a0f0b6afef4cc41cf1497f846c160640bb744

  • SHA512

    fc44ae9113557acc3a2020d69dd04249e71cb95b097227d898329634683bfe81b6e7476a2ea21ba78b21e3823c05bfe67d7ed57d039206708ad616689702b569

  • SSDEEP

    12288:rkVut11vyrXMw51hoTfWfziVyXkpaBD4As8yT/IgSkCJipnNlfU+XgiRtyopPGPx:rs3XMkToibbCWKT/WyVvQodQN2KMxkeE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\unlocker1.9.0-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\unlocker1.9.0-x64.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd22AE.tmp\ioSpecial.ini

    Filesize

    704B

    MD5

    62303cad43688ed22d5c555ca3780786

    SHA1

    345fe92b6db59b8e8376b76f1922b08c15c2a4a1

    SHA256

    240c023f039b2eef4ff4ad27acfc36385ae236f566baba97c1dab9c82ca5f529

    SHA512

    c95a15e98e4ba3a6f9d59ea913016d9815bde943fd935a74b4f97c0ff1c9eb4321a0c891127065cbe726a2712028ec3c4820c839ffb83f31c53267982f707663

  • \Users\Admin\AppData\Local\Temp\nsd22AE.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • \Users\Admin\AppData\Local\Temp\nsd22AE.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf