Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 23:37
General
-
Target
anyunlock-iphone-password-unlocker-en-official-setup.exe
-
Size
14.1MB
-
MD5
d8d56702bf1be2a044d1dcf4c514015a
-
SHA1
41e655363fedc10334566138148bfd636863bd28
-
SHA256
592816a5ca2054f7b0430ffd2e7cc88d9d5ba970a22684f71267be3d8a39eac2
-
SHA512
6b8b42f2935b9bb15875dd8b599d6d991b244c93e0842a828edf075aa05a76434ed0c29e5156f2748b69c91419d26f68f6d9b7152285256d89bb66ea11edc393
-
SSDEEP
196608:L06C6iZ1VR5nVGRXmEY9RRdwMw6C7S2F2euxVQQPZrMYDdauyGCqKilFn+FlZudh:LWnoZmEYXRxrCzb8M2zyLclFnGzTKUIv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-official-setup.exe"C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-official-setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nszB71C.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nszB71C.tmp\setup.exe" ver:2.1.0 gv:2.1.0.1 gs:Official-com-pp lan:en-US2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD562e85098ce43cb3d5c422e49390b7071
SHA1df6722f155ce2a1379eff53a9ad1611ddecbb3bf
SHA256ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
SHA512dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
3.3MB
MD5023dfce70301896fb6b2e15eca718549
SHA164bf799250c2d437b8dd2f0c7c7e6509394565d9
SHA2569140755badab25fcca359fe83f74a4a435ec6136302ddafb489a90f563ad4157
SHA512e47fbb80e62a02018ffd0484e21d9f80bd6469ef0df745d7f5aff7bc5ca91a487bbbcdc2d0a9b0c67352a33c97bced3f0184ba42960f1cf7c6313004fbf4eede
-
Filesize
32KB
-
Filesize
360KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
3.3MB
-
Filesize
128KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB