{"Id":"fdf4f85b-47f4-4c98-a0d5-a6583463f565","Tags":["vmdrv.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create vmdrv.sys binPath=C:\\windows\\temp\\vmdrv.sys type=kernel && sc.exe start vmdrv.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/elastic/protections-artifacts/search?q=VulnDriver"],"Acknowledgement":{"Person":"","Handle":""},"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"KnownVulnerableSamples":[{"Authentihash":{"MD5":"681bb8e9713477839a1ee8d87b498630","SHA1":"68cdcd073e57f650c5d6173cd79af3a3526052f6","SHA256":"99ddeba6bcdc79e52e3ff8afc63dbe4b299161cf0f5558a2d7630c2a18daf2c6"},"Company":"Windows (R) Win 7 DDK provider","Copyright":"Copyright (C) Voicemod S.L.2010-2020","CreationTimestamp":"2022-02-22 15:12:24","Date":"","Description":"Voicemod Virtual Audio Device (WDM)","ExportedFunctions":"","FileVersion":"10.0.10011.16384","Filename":"vmdrv.sys","ImportedFunctions":["RtlInitUnicodeString","KeClearEvent","KeSetEvent","ExFreePool","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ObfDereferenceObject","ExEventObjectType","ExAllocatePoolWithTag","ExFreePoolWithTag","ExSystemTimeToLocalTime","_purecall","KeInitializeDpc","KeFlushQueuedDpcs","KeInitializeMutex","KeReleaseMutex","KeInitializeTimerEx","KeCancelTimer","KeSetTimerEx","KeWaitForSingleObject","KeInitializeSpinLock","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","RtlIsNtDdiVersionAvailable","PcInitializeAdapterDriver","PcDispatchIrp","PcAddAdapterDevice","PcRegisterAdapterPowerManagement","PcNewServiceGroup","PcRegisterSubdevice","PcRegisterPhysicalConnection","PcNewPort"],"Imports":["ntoskrnl.exe","portcls.sys"],"InternalName":"vmdrv.sys","MD5":"d5db81974ffda566fa821400419f59be","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"vmdrv.sys","Product":"Windows (R) Win 7 DDK driver","ProductVersion":"10.0.10011.16384","Publisher":"","RichPEHeaderHash":{"MD5":"f6ca8831520c235d28dbfa26ad735d55","SHA1":"e8d1bb5697814956222cfbf5d0275766135f9ba0","SHA256":"709e3c46eff74215c009624ce48e3d6d65a6e5237d38781232e9cb1844748fcf"},"SHA1":"4c18754dca481f107f0923fb8ef5e149d128525d","SHA256":"32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351","Sections":{".text":{"Entropy":5.72820930665092,"Virtual Size":"0x1466"},".rdata":{"Entropy":4.71043452997573,"Virtual Size":"0x1440"},".data":{"Entropy":1.9612699371321567,"Virtual Size":"0x72c"},".pdata":{"Entropy":4.38228852061058,"Virtual Size":"0x570"},"PAGE":{"Entropy":6.039766687351532,"Virtual Size":"0x2e8a"},"INIT":{"Entropy":5.4515972556240095,"Virtual Size":"0x6da"},".rsrc":{"Entropy":3.595344946345435,"Virtual Size":"0x460"},".reloc":{"Entropy":5.058075646330186,"Virtual Size":"0x188"}},"Signature":["Voicemod Sociedad Limitada","DigiCert Global G3 Code Signing ECC SHA384 2021 CA1","DigiCert Global Root G3"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1","ValidFrom":"2021-04-29 00:00:00","ValidTo":"2036-04-28 23:59:59","Signature":"3065023078bd4995657101d0465768650e68a9dc3608c1eefdd48edb40653f0dff93afc2ae6386a37ecbb4915a78ec070367077c023100e79f1ff1075bac34c638bcb5a550cee6ea387e3e7990e4a45bab020de807fc56a65a8addb350b2ddf2fa66749ed01663","SignatureAlgorithmOID":"1.2.840.10045.4.3.3","IsCertificateAuthority":true,"SerialNumber":"0fb8a740b9158d035143bc59d9f04029","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b4a3c39dbd2935ac070032406fa082e4","SHA1":"891bf1b0a017f5aadbc0d997fe63eb0ec25a1655","SHA256":"81d8278fe4857a2dfa510a0af74deeb0623ef79e25fcf171644808a3ec652305","SHA384":"17653c0976e1370da584b5eaf4a6deb1d3b7cad97c2f12592e7b96c5302b88bde20b30fa5963ef0ac9f2063083b48e9e"}},{"Subject":"??=Private Organization, ??=ES, ??=Valencia, serialNumber=B98657844, C=ES, L=Valencia, O=Voicemod Sociedad Limitada, CN=Voicemod Sociedad Limitada","ValidFrom":"2021-10-21 00:00:00","ValidTo":"2023-01-19 23:59:59","Signature":"3066023100fd8a9d376bf4399c7cb947c5fbb2e90bb3fdbcb37cab257ef47db016f1898e2d129241a757f039f8e7112b05a48632a60231009b75d4e2623fb9f54ce9ffc6ba7a661a5d2d54b096ddf6c510b2f6063981c15846e282779e9febffa39e5c9fad429646","SignatureAlgorithmOID":"1.2.840.10045.4.3.3","IsCertificateAuthority":false,"SerialNumber":"014d8930c6a3fceb0f4021734d5ed508","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"59e2799dd07c9a450f06c376eb220a48","SHA1":"8588e052171ee54d148087ef5e2b8cf81017d199","SHA256":"3a0fbfc101d7832c403769e3f28cdfcea533abdd1461c09b134594a1d21aabe8","SHA384":"6df23072f503ec2ff425603e606c706a149144483579648653c5e1f40c64243b77cc021873ed46c5ac9597ba452f11fc"}}],"Signer":[{"SerialNumber":"014d8930c6a3fceb0f4021734d5ed508","Issuer":"C=US, O=DigiCert, Inc., CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1","Version":1}]}],"Imphash":"7c24141cdcfc23f5eb0e2b6792d80740","LoadsDespiteHVCI":"TRUE"}]}