Extracted

• • Target
    UnlockTool-2026-08-16-0.exe
  • Size 214.9MB
  • SHA256 e00a0c50dbe9c7ffd739c0302c4e29e12d8bc9cf447e3a850ddb3845e3503f91
  • MD5 bd65dd566cc987de00aba024ee95c0b6
  • SHA1 659600d70c3bd32863b9dbdb1a5cc2166574bc7c
  • SHA512 09d203eff55dd8c62fa04f2ad1c6d8815e045d9621b5add8772cd57acaa8db72f32928e019e36b0512e8f25869f79f901d23ec54578a99df74f21e9caab60119
  • SSDEEP 3145728:KopYrW5i/IHiqwa96mn5q7ZmKuT/cI/tCs3UkzDOsZaAOGV9yA508/fRX5:L5izVfA5+YJrBD977fRp
  • TLSH
    T10AB8335F2589C16BEA841670972B59CB01B12DEC456CF87E25C23DBE737FAA22076331
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  microsoftdefense_evasiondiscoveryexecutionwannacryimpactpersistencephishingprivilege_escalationransomwarespywarestealersuricatatrojanwormadware

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Probable phishing domain

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2