Analysis
-
max time kernel
103s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 00:39
General
-
Target
anyunlock-iphone-password-unlocker-en-setup.exe
-
Size
14.2MB
-
MD5
7789530e75705212cf2e99c119b73237
-
SHA1
68162ef7f934cc666a928877d87ba5d0efc098cf
-
SHA256
ad4fad7041437165a835858801b8aed8586bcd50647473c57dcb14b54e52178b
-
SHA512
fe53a49763d2e56db5f9fe524cbfa0490cbdb0af357e562c5c135d8f0c1bfd97201f0c4a80e814c641539506f00349bb6dcaed11256547afbe9a3301b40cba2a
-
SSDEEP
393216:ICn8IdMS8p+WVOS/5ABHBoyYwDVzALQyUIE:ICDdMS8p+WASBaB1JzA89
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-setup.exe"C:\Users\Admin\AppData\Local\Temp\anyunlock-iphone-password-unlocker-en-setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsj8F70.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nsj8F70.tmp\setup.exe" ver:2.1.0 gv:2.1.0.2 gs:Official-com lan:en-US2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD55422e399fabd3a344e8dcc807a48637e
SHA159b0830698b15993671eb0dd43020041c351deb8
SHA25664e6aad5d6628bc743196a42e28df3f8dc71cdf0d2ad4c250bab872d2a3991c7
SHA5129d102954e0d7bb7e69219a14158e410c18adb85d1cca9e269f3955d3fc5e61b23872313b78d16cd6488eaac0f835b233356152575bf130f8ec91e0d481aa1493
-
Filesize
22KB
MD586a488bf743dfab80ff142713adb5d48
SHA102e4b39f2fa40cd4edcc42cb524dc3ce911bfdac
SHA2563924b57f8993a880d53e1e4e18eb6ba9b5dc610cbb00345c954c7e8a9078c309
SHA5120ed09bcddd5bd13a91e7b99b78e37a01a36d62a29ad74acaacbe0da6446c8523e83ed2c089d2847e4d1ba467da93e2fd2de104feb51bcda445511b334bf932c8
-
Filesize
15KB
MD58205bee74d498724aa5508e93c6d21f8
SHA12564cc3032e59d538826596a88d80c3d022ef595
SHA256382aad28fa439b18d3d41a4652201c1d1542d73ff756a738c4cee6b75ebeca8f
SHA51267c1e7fcfbc03565ddcd0cde4a91104231b30e0e3edbfe338ba5da76085fe849ea2dea199554dd3b25b90ab9722c30fd22399932463ef4a95e6000fcb5ef3ca1
-
Filesize
3.3MB
MD5023dfce70301896fb6b2e15eca718549
SHA164bf799250c2d437b8dd2f0c7c7e6509394565d9
SHA2569140755badab25fcca359fe83f74a4a435ec6136302ddafb489a90f563ad4157
SHA512e47fbb80e62a02018ffd0484e21d9f80bd6469ef0df745d7f5aff7bc5ca91a487bbbcdc2d0a9b0c67352a33c97bced3f0184ba42960f1cf7c6313004fbf4eede
-
Filesize
32KB
-
Filesize
360KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
3.3MB
-
Filesize
128KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB