{"Id":"ebdde780-e142-44e7-a998-504c516f4695","Tags":["mhyprotrpg.Sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"147333457f1bc42553237b1e54badabe","SHA1":"75f87f73836acfebcfd7680ff2ca7da356a9720b","SHA256":"5195443274ee3a382e947f03fd409437730434c2af0c1bb1c99f5ba1953f989e"},"Company":"","Copyright":"","CreationTimestamp":"2021-12-20 23:33:43","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["NtQuerySystemInformation","RtlInitUnicodeString","ExAllocatePool","ExFreePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetCurrentProcess","_wcsicmp","RtlInitString","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","IoGetDeviceObjectPointer","ZwClose","MmIsAddressValid","ZwOpenDirectoryObject","ZwQueryDirectoryObject","ObReferenceObjectByName","ZwQuerySystemInformation","__C_specific_handler","MmHighestUserAddress","IoDriverObjectType","KeQueryTimeIncrement","KeStackAttachProcess","KeUnstackDetachProcess","PsGetProcessWow64Process","PsGetProcessPeb","MmUnlockPages","MmGetSystemRoutineAddress","MmUnmapLockedPages","IoFreeMdl","ZwTerminateProcess","PsGetProcessImageFileName","ZwQueryObject","ObOpenObjectByPointer","PsReferenceProcessFilePointer","IoQueryFileDosDeviceName","MmProbeAndLockPages","PsLookupProcessByProcessId","MmMapLockedPagesSpecifyCache","IoAllocateMdl","MmCopyVirtualMemory","KeClearEvent","KeSetEvent","KeWaitForSingleObject","MmMapLockedPages","ObReferenceObjectByHandle","PsSetCreateProcessNotifyRoutineEx","PsSetCreateThreadNotifyRoutine","PsRemoveCreateThreadNotifyRoutine","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","ExEventObjectType","ObRegisterCallbacks","ObUnRegisterCallbacks","ObGetFilterVersion","PsGetProcessId","IoThreadToProcess","strcmp","PsProcessType","PsThreadType","RtlEqualUnicodeString","RtlGetVersion","ObfReferenceObject","ObGetObjectType","ExEnumHandleTable","ExfUnblockPushLock","PsAcquireProcessExitSynchronization","PsReleaseProcessExitSynchronization","_snprintf","vsprintf_s","ZwCreateFile","ZwWriteFile","PsLookupThreadByThreadId","NtQueryInformationThread","PsGetThreadProcess","KeDelayExecutionThread","KdDisableDebugger","KdChangeOption","PsCreateSystemThread","PsTerminateSystemThread","KdDebuggerEnabled","PsGetVersion","KeInitializeEvent","RtlCopyUnicodeString","ObfDereferenceObject","ExReleaseFastMutex","ExAcquireFastMutex","MmBuildMdlForNonPagedPool","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Imports":["ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"a860d74c13d125d7c6253a4dc3b47ddf","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"SHA1":"7ac42dda788b55fd3f32c0c27670c7bc7f5bced4","SHA256":"f7d72d22cd4ad3e44fd617bdb4c90b9a884f4eb045688c0e3fb64dd33e033eaa","Sections":{".text":{"Entropy":6.158075145426797,"Virtual Size":"0x6b90"},".rdata":{"Entropy":4.765869084881738,"Virtual Size":"0x152c"},".data":{"Entropy":0.807954115503613,"Virtual Size":"0x15f8"},".pdata":{"Entropy":7.800461572948713,"Virtual Size":"0x660"},"PAGE":{"Entropy":5.557939798776847,"Virtual Size":"0xb0e"},"INIT":{"Entropy":5.377891226514562,"Virtual Size":"0xeae"},".upx0":{"Entropy":7.132796829919025,"Virtual Size":"0x139a64"},".reloc":{"Entropy":3.8780168751674,"Virtual Size":"0xd8"},".rsrc":{"Entropy":2.9106266625370485,"Virtual Size":"0x22c"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, L=Shanghai, O=miHoYo Co.,Ltd., OU=OPS, CN=miHoYo Co.,Ltd.","ValidFrom":"2019-04-08 00:00:00","ValidTo":"2022-04-08 12:00:00","Signature":"46a5e6f6c38a63b314f7e2677bb86d4bcd7839eef8e006048ddd58c6783ff0657456e61c800efb31966c611f7ca7d1de1785e006e3f4c0b24cb652842e42cbae016320a774724537fc30e8f09895fdb626daa26b5740c7538aa1df1f97dcab12c3a743c2048f6c9a754f66189ac0f21544399798fb780cd347c9cac0443c8d778736938e17cdd5eca8a2338d8171efd61e13c868dff862da9df4ca8c653a227e0971030aa7e6b44dc2199d1ebd9cae00c6f0a3e91bb883cc509fb297902ba5c13e5826071d92178ace51f1a0653b0445cf7ba17226401c92d7db4f67a37d1243f9094ad5f32873891ea5004a8cbfec77129d4955e344492aaee456f852001ded","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"05a7559541e0fdc678d79e3272468907","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3e83a7572d1c522dd9072ba6399029d7","SHA1":"e2c2d59b70f028a66a8711bfa97f842475f84639","SHA256":"5a504a929cb21f72008d5d57bcd992a7cac13f6aa90cbb886b5ecd809e3b59dd","SHA384":"72916ab6c7eb3f5cb7444b3d7d2ac8cb52944605477c5a0f181d060e4edb4c37ebe5eb3c0566dda9de2d2707636ec355"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA","ValidFrom":"2011-04-15 19:41:37","ValidTo":"2021-04-15 19:51:37","Signature":"5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611cb28a000000000026","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"983a0c315a50542362f2bd6a5d71c8d0","SHA1":"8047f476001f5cb16a661d2a3fd0c3576168f5e2","SHA256":"5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83","SHA384":"5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"7b721d64ff88c83ac1b7e9e7a9c487bbdb9492d7905933fa2b87dea85b80253f138f9b831b7c43c4e68cdf393ec315ecb0da3b21257b24c1725db84791811346fa9c3f6a5138deb425cbf0abdfc528015479104624d1380f26a161904dbabd28e63ff1c4aa9bf6da35534fc9f23dd36cdc23edaaa04d6709f33a803d3cfb364c90e776a4ddf23abf56352fa24c65e8e0d4dad1c7c8916a2d234f373b199418d4d59c103cd5b11c19ff8fc86b9b9ef8ae9c999678d1cd9c51155b4226725a8d0a4a239240e886de22c2933ad49b68a6df297f06b93c0ebd9fc4869c82474271328609997209794b9d7169f541ff7f397764f1848dbe8b1eb27d68a3a590b10cff","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0fa8490615d700a0be2176fdc5ec6dbd","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a9a31555bbc92b6033975c5428fb3679","SHA1":"47f4b9898631773231b32844ec0d49990ac4eb1e","SHA256":"c826846e4b1d73edb7561ab1b41c949354e237a91e82fe1be5b7e2e1701f52d1","SHA384":"86f49574f368a561914a52d7ae043ec6784ef8c718960700f834e123594605d25d39f1ad45f1eb5052c9567f3edd0e16"}},{"Subject":"C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Time Stamping CA","ValidFrom":"2019-05-02 00:00:00","ValidTo":"2038-01-18 23:59:59","Signature":"6d5481a5335d16e1b553819175df037a320b2d258411b2b0db2a7d2a05f5bc3b27f45aa0b9495990296c61cbb550dbe27df99f00ef40c3add3e2e456f95841cff142e5107dffb0741f8fc65c09f9335eeaa01c26585cf3b4110fd5d5c3e2bcd55878bf4876e144676d8fb043100f8de4f93862bf1301c585a34cc5ccb2533095a4d6f4965608b8cd5c7f0196be72526a3b42377c1678399393949bb1dcb26d416d67cdc96f903d7f4572c11b23d6c2558466e4b3c56606f6f3d64b5eada32b428a2192fea86f5a2570628173635ea0bbd8dcd74ad33daf830638121d24872de4fc02d63e7704bc0436b5e777cb9c2e8d2318b9a3c2471df05dd6a1735705689aa7c937651dbeeabcd842834305a58ba609ffd1a194a64eaa3d09f5056cb7d2645ad82a22c24b9df1395e4cde483d9b34969a095f8efdf7b15291ce3f89f61ca1b5a9751f71bf5b435d653d50816eabf0d0d3fcb2b31fb6999626f43c798b5c64cccdee279ae5a0c00c7287c16e4d5ad31eeaf044e6326f1ceb174e94c37865203b0f41aa1fe9a1419dfeb1b8a0652a34e0dea8f93ce6c130bbc0a0632cfc5c1600a8d0c47fea119d1e06c6a66d325db438092b4907aafdec30daf1a72fcfb7fdfad0a384d9279efb016677b95610e1206ec6aeb1f9b6bac8355d33768ef17c200c2a77aeb5a20286ba29eeb45a00b18cabe3f90ac9545dd4b96a749ebd48ae98","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"300f6facdd6698747ca94636a7782db9","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"63499ed59a1293b786649470e4ce0bd7","SHA1":"7309d8eaa65da1f3da7030c08f00a3b0a20fa908","SHA256":"8c8d2046b29e792e71b28705fe67c435208a336dde074a75452d98e72c734937","SHA384":"5dbc5eae13908fee4c4e5216f87e3e87208fff0d1052f5fa9f0856a429d6a6c422c625f2318f2f29aea26ece09c1e811"}},{"Subject":"C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Time Stamping Signer #2","ValidFrom":"2020-10-23 00:00:00","ValidTo":"2032-01-22 23:59:59","Signature":"4a0378904233ec7b1a830936339855bb9d4006306b456af1940e1950ff5b255e3be139c45bbae995903737bddffb64ece582b795cc5755704b4ef4a887dd2285a657bbb82127d4a02a31948a07219e8abda71af50215cb4450998cec3eba0377a6820290c22e93a9be21347563b9e02d0fcf0137cb8da2fab85a9aaea17a9e139319558f09902edfea881716eb69d6e125bd45089780d75420284fca7bb3b3a5d200b0603465c4e3c5c3a5e4ba85aa7a69db75a43e79689a368b43ae36d461723c0e85620da05e70db642f01c7c1a1c72494a3b23c6eb25ea2d0faa8d1b8251c16e6c0d57f681ac46529352a2d88bceaae74d682e7c088b8e14f78f05ccac0405cc29fd5321c2cda3cac36f706529aa3403017b0291699c9aab78849f7e80b2533b53f6daf9f5f0a56df12b1c3eece9177e82013e95c24c7ea440b4ae613841c4deb0db5b886a030a78ba19fb42cccc01623c991e542034b80cee44de62a013ec05e85a024a11740d5dbdbe79810a4f1ea191b8054fa4789e89881a975c00edfd0689479a1a09e8eb6b74266cbd9d96b2f4dd8de3e321e20e4ec9c4d428d9dc73399823744d4262926408e782fb9eefa2ff1f18ffe50b878dd1496de1c0e70b02a856ab16c68e92ae4102b6e21fdd37c9d37e42a06d6c3f1d768e34f0779810813feb2645ee9b13ce6d07823b2092ce22662bf3ba99751ccc7443281b2afcfdf","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":false,"SerialNumber":"008c77a0008ff4d1b0c63d9f3a48838d6b","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"6efd500ce038df7aa3087c1e63a5eb5c","SHA1":"1c961712a02fb995c585080eda53a753656ca3ad","SHA256":"f60d4f8f7b56499de889264b1e64890694c5b106129d3db068976ed33495577a","SHA384":"031fdf7c078e205b4d3ffaff40de36f48f91f87c3b0005b482ff614b320f5e47785045cb87a3e6a75085c24ae8409498"}}],"Signer":[{"SerialNumber":"05a7559541e0fdc678d79e3272468907","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA,1","Version":1}]}],"Imphash":"ebb99842fa08915eb8b7f67d8dc7a13a","LoadsDespiteHVCI":"FALSE"}]}