Overview
overview
7Static
static
3ToolsUnlock.zip
windows10-2004-x64
1ToolsUnlock.zip
windows11-ltsc_2024-x64
1Manual.txt
windows10-2004-x64
1Manual.txt
windows11-ltsc_2024-x64
1Tools_Unlock_Pro.rar
windows10-2004-x64
1Tools_Unlock_Pro.rar
windows11-ltsc_2024-x64
1MEIPreload...rs.dll
windows10-2004-x64
7MEIPreload...el.dll
windows10-2004-x64
1MEIPreload...re.dll
windows10-2004-x64
3MEIPreload...re.dll
windows11-ltsc_2024-x64
3MEIPreload/Qt5Gui.dll
windows10-2004-x64
3MEIPreload/Qt5Gui.dll
windows11-ltsc_2024-x64
3MEIPreload...rk.dll
windows10-2004-x64
3MEIPreload...rk.dll
windows11-ltsc_2024-x64
3Readme.txt
windows10-2004-x64
1Readme.txt
windows11-ltsc_2024-x64
1locales/ca.pak
windows10-2004-x64
3locales/ca.pak
windows11-ltsc_2024-x64
3locales/hi.pak
windows10-2004-x64
3locales/hi.pak
windows11-ltsc_2024-x64
3locales/it.pak
windows10-2004-x64
3locales/it.pak
windows11-ltsc_2024-x64
3locales/ja.pak
windows10-2004-x64
3locales/ja.pak
windows11-ltsc_2024-x64
3locales/lv.pak
windows10-2004-x64
3locales/lv.pak
windows11-ltsc_2024-x64
3locales/ml.pak
windows10-2004-x64
3locales/ml.pak
windows11-ltsc_2024-x64
3locales/ms.pak
windows10-2004-x64
3locales/ms.pak
windows11-ltsc_2024-x64
3locales/nl.pak
windows10-2004-x64
3locales/nl.pak
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
ToolsUnlock.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ToolsUnlock.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Manual.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Manual.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Tools_Unlock_Pro.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Tools_Unlock_Pro.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
MEIPreload/CPFilters.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
MEIPreload/CredProvDataModel.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
MEIPreload/Qt5Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
MEIPreload/Qt5Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
MEIPreload/Qt5Gui.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
MEIPreload/Qt5Gui.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
MEIPreload/Qt5Network.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
MEIPreload/Qt5Network.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Readme.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Readme.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
locales/ca.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
locales/ca.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
locales/hi.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
locales/hi.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
locales/it.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/it.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
locales/ja.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
locales/ja.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
locales/lv.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
locales/lv.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
locales/ml.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
locales/ml.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
locales/ms.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
locales/ms.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
locales/nl.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
locales/nl.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Tools_Unlock_Pro.rar
- Size 138.2MB
- Sample261014-2tesnatwcx
- SHA256 14379585c1c0bcf25b03ea53407774a3c9034baedf9ae6944a2f58c96740c6b1
- MD5 f4a8766ecdf08bb61c6d36e0569ac2f3
- SHA1 966ba0bba47812e9bf6be777bbe1968e1ec729f1
- SHA512 3f89a057d0794eba91244d6fff9a6416efe715dd12a250679301c2fc47cbbc4d8118dbfa2782ea21f6331d9f15ddebd13880fa23eeda58836ab98d7f56904506
- SSDEEP 3145728:rjvxm143ByK0xB52k7t4VAbWdoOO2ZJQJIyhEqeyXSHfPL77:rbxmgHa5b7tvWbOaJQAwa777
- TLSH T19B6833DD16993B3C82489D92C6C8BB7B44FADB23B66FD54A81E7B450CB2336DE21014D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5984 7zFM.exe Token: 35 5984 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5984 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Tools_Unlock_Pro.rar"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1712