| File name: | dc unlocker cracked version download.7z |
| Full analysis: | https://app.any.run/tasks/2e0064d1-5f82-4553-a481-8e728817f873 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | November 30, 2024, 21:01:24 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 475DB021DFF3F90E1C06A9417D7BA72B |
| SHA1: | 84C254C9C8FDCF4C5ACCB5EFE1EAA707579555D5 |
| SHA256: | D068B0E6A5A7260D5E6544376212031EC549CA3E8A7C9771DDB993DD2E032A8D |
| SSDEEP: | 98304:NDj3Ry9L1jRdipQ77WoBqIESrlaNLIlpxUJXsdrx6aJbnBSTvPQ3lBgJgIhvP8/p:NHulMAeVkamA6NqnOQ6zFd |
MALICIOUS
Executing a file with an untrusted certificate
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
AutoIt loader has been detected (YARA)
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
Steals credentials from Web Browsers
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
Actions looks like stealing of personal data
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
SUSPICIOUS
Reads security settings of Internet Explorer
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Starts CMD.EXE for commands execution
- dc unlocker cracked version download.exe (PID: 7072)
- cmd.exe (PID: 6172)
- dc unlocker cracked version download.exe (PID: 6484)
- cmd.exe (PID: 7016)
Executing commands from ".cmd" file
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Get information on the list of running processes
- cmd.exe (PID: 6172)
- cmd.exe (PID: 7016)
Application launched itself
- cmd.exe (PID: 6172)
- cmd.exe (PID: 7016)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 6172)
- cmd.exe (PID: 7016)
Executable content was dropped or overwritten
- cmd.exe (PID: 6172)
The executable file from the user directory is run by the CMD process
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
Starts application with an unusual extension
- cmd.exe (PID: 6172)
- cmd.exe (PID: 7016)
Starts the AutoIt3 executable file
- cmd.exe (PID: 6172)
- cmd.exe (PID: 7016)
INFO
Create files in a temporary directory
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Reads the computer name
- dc unlocker cracked version download.exe (PID: 7072)
- Commissioners.com (PID: 936)
- dc unlocker cracked version download.exe (PID: 6484)
- Commissioners.com (PID: 2800)
Manual execution by a user
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Checks supported languages
- dc unlocker cracked version download.exe (PID: 7072)
- Commissioners.com (PID: 936)
- dc unlocker cracked version download.exe (PID: 6484)
- Commissioners.com (PID: 2800)
The process uses the downloaded file
- WinRAR.exe (PID: 6816)
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Process checks computer location settings
- dc unlocker cracked version download.exe (PID: 7072)
- dc unlocker cracked version download.exe (PID: 6484)
Creates a new folder
- cmd.exe (PID: 4052)
- cmd.exe (PID: 6160)
Reads the software policy settings
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
Reads mouse settings
- Commissioners.com (PID: 936)
- Commissioners.com (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|
Total processes
150
Monitored processes
25
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 836 | cmd /c copy /b ..\Stations + ..\Keep + ..\Disposition + ..\Gently + ..\Warning + ..\Nursery w | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 936 | Commissioners.com w | C:\Users\admin\AppData\Local\Temp\119779\Commissioners.com | cmd.exe | ||||||||||||
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 4 Modules
| |||||||||||||||
| 1752 | choice /d y /t 5 | C:\Windows\SysWOW64\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Offers the user a choice Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2224 | findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2800 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2800 | Commissioners.com w | C:\Users\admin\AppData\Local\Temp\119779\Commissioners.com | cmd.exe | ||||||||||||
User: admin Company: AutoIt Team Integrity Level: HIGH Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 4 Modules
| |||||||||||||||
| 3220 | findstr /I "wrsa opssvc" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3808 | findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4052 | cmd /c md 119779 | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4120 | findstr /I "wrsa opssvc" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 387
Read events
3 368
Write events
19
Delete events
0
Modification events
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\dc unlocker cracked version download.7z | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
Executable files
1
Suspicious files
9
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6816 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6816.30699\dc unlocker cracked version download.exe | — | |
MD5:— | SHA256:— | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Disposition | binary | |
MD5:A5A589BFA79B4D8BD653FC332C97968C | SHA256:6DCD868CC34AAADC2594C104B36F48C7A59F6A0731B07FC5273B3D339271ECC0 | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Warning | binary | |
MD5:AD2BC8BF7DA13816B2A1AD79A7CBB88D | SHA256:DAD4725428229A1349A1AF9A37A52C84DB461A67ACD8E238C8C71F96FB2E11EC | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Lexmark | binary | |
MD5:6EFECD2FE610AB4C8E8DB9B9A68D7AFE | SHA256:CBBC034E4971FA600DAC27F640B0008D0C4B5B037AB13A4952258A406F11F8ED | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Stations | binary | |
MD5:D3825A98C95C5D85DFE22E8838CCE987 | SHA256:AF22DD512C5D869A5D3E98EDB5B2E617574A5E091A361748710948FC7A145B5D | |||
| 836 | cmd.exe | C:\Users\admin\AppData\Local\Temp\119779\w | binary | |
MD5:D6A5E971000721FF5058364FECD7DCC7 | SHA256:C0C385A12DDA1A32F4CA03CF946DF82D5E5DDD2306B623176E7A0E051208331E | |||
| 5792 | cmd.exe | C:\Users\admin\AppData\Local\Temp\119779\w | binary | |
MD5:D6A5E971000721FF5058364FECD7DCC7 | SHA256:C0C385A12DDA1A32F4CA03CF946DF82D5E5DDD2306B623176E7A0E051208331E | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Nursery | binary | |
MD5:3556C0F5F352B3539587354814F22300 | SHA256:2E4A392F6E742A37DBF86091849DC3E79B760AE3396DAFDFEE6956285C12E41B | |||
| 7072 | dc unlocker cracked version download.exe | C:\Users\admin\AppData\Local\Temp\Gently | binary | |
MD5:BCC78CE5622B52B500C28D5EB62E9C61 | SHA256:094C2938B544FF3A147715790003359DDB15BD81D901DF57C9FE680941F2A91F | |||
| 6172 | cmd.exe | C:\Users\admin\AppData\Local\Temp\Request.cmd | text | |
MD5:82F2B8BD0E93EABC60748A1953027FEE | SHA256:BE587A64F5FF429CE933BC515D6E3B24363091D58F01C6E363BF206D39C32A38 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
46
DNS requests
24
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6552 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5728 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5728 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
536 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 2.23.209.133:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |