Overview
overview
10Static
static
3Unlock_Tool_2.3.rar
windows10-2004-x64
10LICENSE.html
windows10-2004-x64
3TypeSuppor...6l.dat
windows10-2004-x64
3TypeSuppor...es.pak
windows10-2004-x64
3TypeSuppor...ol.txt
windows10-2004-x64
3TypeSuppor...at.txt
windows10-2004-x64
3TypeSuppor...AR.txt
windows10-2004-x64
3TypeSuppor...IC.txt
windows10-2004-x64
3TypeSuppor...ND.txt
windows10-2004-x64
3TypeSuppor...AN.txt
windows10-2004-x64
3TypeSuppor...SH.txt
windows10-2004-x64
3TypeSuppor...50.txt
windows10-2004-x64
3TypeSuppor...52.txt
windows10-2004-x64
3TypeSuppor...54.txt
windows10-2004-x64
3TypeSuppor...58.txt
windows10-2004-x64
3Unlock_Tool_2.3.exe
windows10-2004-x64
3langs/English.ini
windows10-2004-x64
1langs/Hungarian.ini
windows10-2004-x64
1langs/Japanese.ini
windows10-2004-x64
1langs/SimpChinese.ini
windows10-2004-x64
1langs/Slovak.ini
windows10-2004-x64
1langs/Thai.ini
windows10-2004-x64
1lesseeVari...es.dll
windows10-2004-x64
1locales/re...me.dll
windows10-2004-x64
1locales/re...me.dll
windows10-2004-x64
1locales/re...me.dll
windows10-2004-x64
1locales/re...ro.dll
windows10-2004-x64
1locales/re...le.dll
windows10-2004-x64
1locales/re...le.dll
windows10-2004-x64
1locales/re...ng.dll
windows10-2004-x64
1locales/re...le.xml
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Unlock_Tool_2.3.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
LICENSE.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
TypeSupport/Unicode/ICU/icudt26l.dat
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
TypeSupport/Unicode/ICU/resources.pak
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
TypeSupport/Unicode/Mappings/Adobe/symbol.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
TypeSupport/Unicode/Mappings/Mac/CORPCHAR.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
TypeSupport/Unicode/Mappings/Mac/CYRILLIC.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
TypeSupport/Unicode/Mappings/Mac/ICELAND.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
TypeSupport/Unicode/Mappings/Mac/ROMANIAN.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
TypeSupport/Unicode/Mappings/Mac/TURKISH.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
TypeSupport/Unicode/Mappings/win/CP1250.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
TypeSupport/Unicode/Mappings/win/CP1252.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
TypeSupport/Unicode/Mappings/win/CP1254.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
TypeSupport/Unicode/Mappings/win/CP1258.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Unlock_Tool_2.3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
langs/English.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
langs/Hungarian.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
langs/Japanese.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
langs/SimpChinese.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
langs/Slovak.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
langs/Thai.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
lesseeVariant/modules.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
locales/resources/Data/Managed/Unity.Postprocessing.Runtime.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
locales/resources/Data/Managed/Unity.RenderPipelines.Core.Runtime.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
locales/resources/Data/Managed/Unity.RenderPipelines.Lightweight.Runtime.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
locales/resources/Data/Managed/Unity.TextMeshPro.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
locales/resources/Data/Managed/UnityEngine.AIModule.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
locales/resources/Data/Managed/UnityEngine.ARModule.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
locales/resources/Data/Managed/UnityEngine.Networking.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
locales/resources/Data/Managed/UnityEngine.TimelineModule.xml
Resource
win10v2004-20241007-en
General
-
Target
langs/Slovak.ini
-
Size
109KB
-
MD5
fcba4d2df72a46575ca828c807224431
-
SHA1
265e34f895f4b2fbe98a39b960c385be7309dfaa
-
SHA256
b5b2f7fc1c62f1c8161ec59af79cf5e8f12cb0070264703087dcc5cb58e7352a
-
SHA512
6edf1e1484225455b76a1deb6c9f02857433a941bc0aececb916f0aede4398a4f22e70e9c152bd6a78ba2f02f11237a6ee92fb05b21374d250f680b56c6a5cc1
-
SSDEEP
3072:2ykd4BlB1wCoG9Yhgt8VQcGlW2Jw/6ro5pw9v6Nv83diJoTNfaRlnCoUjZ5bYtZr:P1wCnyNYpCaAWK
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4396 NOTEPAD.EXE
Processes
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 663065
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C2D1AA6AB7094E6DBCE2C6A048CD05BC Ref B: LON601060108029 Ref C: 2024-10-16T22:53:26Z
date: Wed, 16 Oct 2024 22:53:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418585_1K319IV1QEN3HBC0V&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418585_1K319IV1QEN3HBC0V&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 443925
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DC2B0C7094C54E739BC78C495950258F Ref B: LON601060108029 Ref C: 2024-10-16T22:53:26Z
date: Wed, 16 Oct 2024 22:53:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 594481
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3658D0709866418DBB0B305C85406F0D Ref B: LON601060108029 Ref C: 2024-10-16T22:53:26Z
date: Wed, 16 Oct 2024 22:53:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301035_1FUDWJ8GFFIFDV49E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301035_1FUDWJ8GFFIFDV49E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 1054100
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0845DF2855884330A1D65843EABF1712 Ref B: LON601060108029 Ref C: 2024-10-16T22:53:26Z
date: Wed, 16 Oct 2024 22:53:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418586_15W93I98EWXDJY7GO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418586_15W93I98EWXDJY7GO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 488476
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CDE71FC5ACE247FB9AC8F3E285A5E4C6 Ref B: LON601060108029 Ref C: 2024-10-16T22:53:26Z
date: Wed, 16 Oct 2024 22:53:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301468_1K7Q0DK1RQ5AV6436&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301468_1K7Q0DK1RQ5AV6436&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 1020983
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1A0E2F9ED289433691AD1AE0DCF2DC4A Ref B: LON601060108029 Ref C: 2024-10-16T22:53:32Z
date: Wed, 16 Oct 2024 22:53:31 GMT
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317301468_1K7Q0DK1RQ5AV6436&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2152.7kB 4.4MB 3224 3217
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418585_1K319IV1QEN3HBC0V&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301035_1FUDWJ8GFFIFDV49E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418586_15W93I98EWXDJY7GO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301468_1K7Q0DK1RQ5AV6436&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200 -
1.2kB 6.9kB 16 13
-
1.2kB 6.9kB 15 13
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
205.47.74.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10