4bf4b425-10af-4cd4-88e6-beb4b947eb48

IObitUnlocker.sys

We were not able to verify the hash of this driver successfully, it has not been confirmed.

Description

IObitUnlocker.sys is a vulnerable driver and more information will be added as found.

  • UUID: 4bf4b425-10af-4cd4-88e6-beb4b947eb48
  • Created: 2023-01-09
  • Author: Michael Haag
  • Acknowledgement: |

Download

This download link contains the vulnerable driver!

Commands

sc.exe create IObitUnlocker.sys binPath=C:\windows\temp\IObitUnlocker.sys     type=kernel && sc.exe start IObitUnlocker.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
  • https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

    • Known Vulnerable Samples

    PropertyValue
    FilenameIObitUnlocker.sys
    Creation Timestamp2022-08-17 02:18:15
    MD52391fb461b061d0e5fccb050d4af7941
    SHA17c6cad6a268230f6e08417d278dda4d66bb00d13
    SHA256f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004
    Authentihash MD5751c91ae91cb43aadaeaa1bb187c593a
    Authentihash SHA1dd220acea885a954085e614b94da2b5bba5c0cc3
    Authentihash SHA256e0aff24a54400fe9f86564b8ce9f874e7ff51e96085ff950baff05844cff2bd1
    RichPEHeaderHash MD535ffa69ed506b3a5d24d6e9c10f88070
    RichPEHeaderHash SHA1a5d21268d58eebe7c8e0921d0079974d8541ffb7
    RichPEHeaderHash SHA2567068185b0f6869fa20b8c64c2e6f2c3bedc161bc4118e602df47da640013cb62
    CompanyIObit Information Technology
    DescriptionUnlocker Driver
    ProductUnlocker
    OriginalFilenameIObitUnlocker.sys

    Download

    Certificates

    Expand
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 0d98f5df96c592c5b76bfde1cb823096
    FieldValue
    ToBeSigned (TBS) MD5d0ba095f2bdb679cea084b4106479484
    ToBeSigned (TBS) SHA180aba0ecbd2b71c84bc73ac42963bc9ce247a020
    ToBeSigned (TBS) SHA256a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa
    Subject??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD
    ValidFrom2019-08-27 00:00:00
    ValidTo2022-08-30 12:00:00
    Signature89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0d98f5df96c592c5b76bfde1cb823096
    Version3
    Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06
    FieldValue
    ToBeSigned (TBS) MD5f92649915476229b093c211c2b18e6c4
    ToBeSigned (TBS) SHA12d54c16a8f8b69ccdea48d0603c132f547a5cf75
    ToBeSigned (TBS) SHA2562cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0dd0e3374ac95bdbfa6b434b2a48ec06
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • ExAllocatePoolWithTag
    • IoDeleteSymbolicLink
    • ExFreePoolWithTag
    • IoDeleteDevice
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoCreateDevice
    • _wcsnicmp
    • ZwReadFile
    • IoGetRelatedDeviceObject
    • MmGetSystemRoutineAddress
    • KeInitializeEvent
    • ExInterlockedPopEntryList
    • KeDelayExecutionThread
    • IoFileObjectType
    • ZwWaitForSingleObject
    • ZwCreateFile
    • ExAllocatePool
    • IoGetCurrentProcess
    • ZwClose
    • ObReferenceObjectByHandle
    • KeWaitForSingleObject
    • RtlCompareUnicodeString
    • IoAllocateIrp
    • ObfDereferenceObject
    • ZwQueryInformationFile
    • ZwWriteFile
    • ObOpenObjectByPointer
    • DbgPrint
    • IofCallDriver
    • _wcsicmp
    • PsGetProcessPeb
    • PsLookupProcessByProcessId
    • ZwQuerySymbolicLinkObject
    • RtlInitUnicodeString
    • KeSetEvent
    • RtlAppendUnicodeToString
    • IoCreateFile
    • ZwQuerySystemInformation
    • ZwOpenSymbolicLinkObject
    • KeUnstackDetachProcess
    • ObQueryNameString
    • wcsrchr
    • ZwQueryDirectoryFile
    • _vsnwprintf
    • RtlAppendUnicodeStringToString
    • ZwDuplicateObject
    • IoFreeIrp
    • ZwOpenProcess
    • PsGetCurrentProcessId
    • MmIsAddressValid
    • ZwTerminateProcess
    • ExInterlockedPushEntryList
    • KeStackAttachProcess
    • KeBugCheckEx
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "61204db4000000000027",
      "Signature": "208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA",
      "TBS": {
        "MD5": "8e3ffc222fbcebdbb8b23115ab259be7",
        "SHA1": "ee20bff28ffe13be731c294c90d6ded5aae0ec0e",
        "SHA256": "59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821",
        "SHA384": "f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"
      },
      "ValidFrom": "2011-04-15 19:45:33",
      "ValidTo": "2021-04-15 19:55:33",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0d98f5df96c592c5b76bfde1cb823096",
      "Signature": "89d53256ccf4b2e50a8e05d88de9ed33f6adde16e143a6f7f042ec4ed9220c7c4195b543ad1ae9c5ae5421f192140d62b28449c83a0c31759765c127fed77c447072976f2d5e8d44e07dafbbc5a0cea9e8020081c3f8a22a1519e53d8c69ff3ffbd7e090e92593a738b8bd6d583b27e5e797672294147fd1b8492683b1b3f202c3e0c571f9fad02d95f8204e054fa722ac42bf21e54ec1891942ab339f004ab57cb01838539bf5196fc1579e0add7c42206ff5e10bb0934b4a801fab12ed748a6a858af5c9601296ce6ca9b14b46f731a0485f49f142ab65dacb0103daaee13b2269f2c2b2d2bb2b04abe93642ecc988fa536170194acc1c73d48a781d3d5f0e",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "??=CN, ??=Sichuan, ??=Wuhou District, Chengdu, ??=Private Organization, serialNumber=91510107072412418F, C=CN, ST=Sichuan, L=Chengdu, O=IObit CO., LTD, CN=IObit CO., LTD",
      "TBS": {
        "MD5": "d0ba095f2bdb679cea084b4106479484",
        "SHA1": "80aba0ecbd2b71c84bc73ac42963bc9ce247a020",
        "SHA256": "a93f8b7111c3e2288e164e42131e2ad52867060479ade1f6e6b3124cde822cfa",
        "SHA384": "8293c567ba382434adab5899693e47e5d6e06c0b9f3c158bf17675d5a1476627db51d00dc9573bf4b89412617e651ba6"
      },
      "ValidFrom": "2019-08-27 00:00:00",
      "ValidTo": "2022-08-30 12:00:00",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "0dd0e3374ac95bdbfa6b434b2a48ec06",
      "Signature": "9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA",
      "TBS": {
        "MD5": "f92649915476229b093c211c2b18e6c4",
        "SHA1": "2d54c16a8f8b69ccdea48d0603c132f547a5cf75",
        "SHA256": "2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb",
        "SHA384": "511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"
      },
      "ValidFrom": "2012-04-18 12:00:00",
      "ValidTo": "2027-04-18 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA",
      "SerialNumber": "0d98f5df96c592c5b76bfde1cb823096",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2024-04-09