{"Id":"6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8","Tags":["kbdcap64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create kbdcap64.sys binPath=C:\\windows\\temp\\kbdcap64.sys type=kernel && sc.exe start kbdcap64.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"kbdcap64.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA256":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"83660d245fe618ecafe4900ac1e2ad0292c2da2a","SHA256":"72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1"}},{"Authentihash":{"MD5":"038cbc948ff5ba06ac0b54ca31401fe4","SHA1":"83660d245fe618ecafe4900ac1e2ad0292c2da2a","SHA256":"72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1"},"Company":"","Copyright":"","CreationTimestamp":"2019-11-04 01:10:09","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["MmUnmapLockedPages","KeClearEvent","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterPlugPlayNotification","KeReadStateEvent","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","KeInitializeEvent","KeReleaseSpinLock","IoDetachDevice","MmBuildMdlForNonPagedPool","IoFreeMdl","IoCancelIrp","KeDelayExecutionThread","ObQueryNameString","IoDriverObjectType","wcsstr","MmMapLockedPagesSpecifyCache","ExInterlockedInsertHeadList","ExAllocatePool","ExInterlockedInsertTailList","PoStartNextPowerIrp","IoUnregisterPlugPlayNotification","IofCompleteRequest","ObReferenceObjectByHandle","IoAttachDeviceToDeviceStack","PoCallDriver","ExInterlockedRemoveHeadList","IoCreateSymbolicLink","ObfDereferenceObject","ObReferenceObjectByName","IoCreateDevice","DbgPrint","IoAllocateMdl","IofCallDriver","KeAcquireSpinLockRaiseToDpc","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"13bd61916343d94ebefc9a7911d7bf88","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"a53e7b4810b8e8a6646827967165e841","SHA1":"6e089a0ffce20d92395e42c69b619bf59c140999","SHA256":"6d1066a1530eeb73686043235fe52052b0934d77e8e9ee471b0c67bfa61172c5"},"SHA1":"44a3a00394a6d233a27189482852babf070ffebe","SHA256":"97030f3c81906334429afebbf365a89b66804ed890cd74038815ca18823d626c","Sections":{".text":{"Entropy":6.286294718424334,"Virtual Size":"0x1c97"},".rdata":{"Entropy":4.142075435632616,"Virtual Size":"0x33c"},".data":{"Entropy":0.4316511568077503,"Virtual Size":"0x150"},".pdata":{"Entropy":3.6825504342841513,"Virtual Size":"0xd8"},"INIT":{"Entropy":5.082788661818898,"Virtual Size":"0x594"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=CN, ??=Shanghai, ??=Private Organization, serialNumber=9131010707118381X9, C=CN, ST=Shanghai, L=Shanghai, O=, CN=","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-19 12:00:00","Signature":"3a72522da9ea787347ffe4ac96c364ffda35372ea83b3427ca0bb30d1478767ed738daaf84648998b3557ff959565e4000ffadb512d64361834b9ad550365a25a69f95ef9e7a4a38294ae14e9edd1724230f84b35deb1cedb5dc3f53d80ddfe9488df913ce93bf1a3989c325424bc35b601a0e85af646c3d764688e1922ba094b4c0e1de92186f4a0d0c1cad81673f9fca92b58e180101d9215fae80d2d42fe02c20fb1602a1cb72ec472d1d4725f1de0f76849cbd02cb7397920c623dbdebe4ea5d94b273ca1180cc5f29b45cc7c064a1bb7fa22f2d8e8e43d85c5e716481cb7beea87bb70eb5672220cec0ba61f08cbffb48114e48c11b1cdc3a13de5d221a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"62acdecc22447b159a7e2efb0350bd63","SHA1":"ddd0bd1dded2c9189fc5b8563f8210deb83c590b","SHA256":"ae3a19b6b64e739d5d2abb0e1471874b7d8b6b1e3f1e38ed483166a664355a4e","SHA384":"9af686e9341ce78dc60186100fa406916c8b90ea25a604401ffe99f3e2c4bfcf20e9106e1cfc05414972a2e069dae5e0"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"Imphash":"b679ac08daf4b4ce8a58d85a8e0904ac","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"038cbc948ff5ba06ac0b54ca31401fe4","SHA1":"83660d245fe618ecafe4900ac1e2ad0292c2da2a","SHA256":"72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1"},"Company":"","Copyright":"","CreationTimestamp":"2019-11-04 01:10:09","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["MmUnmapLockedPages","KeClearEvent","IoDeleteSymbolicLink","ExFreePoolWithTag","IoRegisterPlugPlayNotification","KeReadStateEvent","MmMapLockedPages","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","KeInitializeEvent","KeReleaseSpinLock","IoDetachDevice","MmBuildMdlForNonPagedPool","IoFreeMdl","IoCancelIrp","KeDelayExecutionThread","ObQueryNameString","IoDriverObjectType","wcsstr","MmMapLockedPagesSpecifyCache","ExInterlockedInsertHeadList","ExAllocatePool","ExInterlockedInsertTailList","PoStartNextPowerIrp","IoUnregisterPlugPlayNotification","IofCompleteRequest","ObReferenceObjectByHandle","IoAttachDeviceToDeviceStack","PoCallDriver","ExInterlockedRemoveHeadList","IoCreateSymbolicLink","ObfDereferenceObject","ObReferenceObjectByName","IoCreateDevice","DbgPrint","IoAllocateMdl","IofCallDriver","KeAcquireSpinLockRaiseToDpc","KeBugCheckEx","__C_specific_handler"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"91203acddac81511d17a68a030d063a8","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"a53e7b4810b8e8a6646827967165e841","SHA1":"6e089a0ffce20d92395e42c69b619bf59c140999","SHA256":"6d1066a1530eeb73686043235fe52052b0934d77e8e9ee471b0c67bfa61172c5"},"SHA1":"f5293ac70d75cdfe580ff6a9edcc83236012eaf1","SHA256":"0b8887921e4a22e24fd058ba5ac40061b4bb569ac7207b9548168af9d6995e7c","Sections":{".text":{"Entropy":6.286294718424334,"Virtual Size":"0x1c97"},".rdata":{"Entropy":4.142075435632616,"Virtual Size":"0x33c"},".data":{"Entropy":0.4316511568077503,"Virtual Size":"0x150"},".pdata":{"Entropy":3.6825504342841513,"Virtual Size":"0xd8"},"INIT":{"Entropy":5.082788661818898,"Virtual Size":"0x594"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=CN, ??=Shanghai, ??=Private Organization, serialNumber=9131010707118381X9, C=CN, ST=Shanghai, L=Shanghai, O=, CN=","ValidFrom":"2019-08-27 00:00:00","ValidTo":"2022-08-19 12:00:00","Signature":"3a72522da9ea787347ffe4ac96c364ffda35372ea83b3427ca0bb30d1478767ed738daaf84648998b3557ff959565e4000ffadb512d64361834b9ad550365a25a69f95ef9e7a4a38294ae14e9edd1724230f84b35deb1cedb5dc3f53d80ddfe9488df913ce93bf1a3989c325424bc35b601a0e85af646c3d764688e1922ba094b4c0e1de92186f4a0d0c1cad81673f9fca92b58e180101d9215fae80d2d42fe02c20fb1602a1cb72ec472d1d4725f1de0f76849cbd02cb7397920c623dbdebe4ea5d94b273ca1180cc5f29b45cc7c064a1bb7fa22f2d8e8e43d85c5e716481cb7beea87bb70eb5672220cec0ba61f08cbffb48114e48c11b1cdc3a13de5d221a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"62acdecc22447b159a7e2efb0350bd63","SHA1":"ddd0bd1dded2c9189fc5b8563f8210deb83c590b","SHA256":"ae3a19b6b64e739d5d2abb0e1471874b7d8b6b1e3f1e38ed483166a664355a4e","SHA384":"9af686e9341ce78dc60186100fa406916c8b90ea25a604401ffe99f3e2c4bfcf20e9106e1cfc05414972a2e069dae5e0"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0dd0e3374ac95bdbfa6b434b2a48ec06","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f92649915476229b093c211c2b18e6c4","SHA1":"2d54c16a8f8b69ccdea48d0603c132f547a5cf75","SHA256":"2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb","SHA384":"511b0e0d7f3a48935cf2413348ff5f327887dc1e58f887bb5ed528d09f79173b55ab6439cf097fc7693b5749f7304ace"}}],"Signer":[{"SerialNumber":"09b92d7a420083c94eaf18145cfaedd1","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA","Version":1}]}],"Imphash":"b679ac08daf4b4ce8a58d85a8e0904ac","LoadsDespiteHVCI":"FALSE"}]}