{"Id":"dbb58de1-a1e5-4c7f-8fe0-4033502b1c63","Tags":["asas.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"f5938db81d1e620b5c89ca0c5f157a33","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"d10a054c6c3b1243cb13ff6648cd5de21a0b6548","SHA256":"6165491e8391eac9c0e3b9a2a31e1692a567c16cbfa36d7a88c401ffae1f6c63","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":{},"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"}]}