{"Id":"ff74f03e-e4ce-4242-bfe3-60601056bb34","Tags":["CorsairLLAccess64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create CorsairLLAccess64.sys binPath=C:\\windows\\temp\\CorsairLLAccess64.sys     type=kernel && sc.exe start CorsairLLAccess64.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/elastic/protections-artifacts/search?q=VulnDriver","https://github.com/magicsword-io/LOLDrivers/issues/302"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"daa859bc87e256d7cbf1d86285d96f9b","SHA1":"d29d73b2add87a7daf3c626d593599ef6b9560ca","SHA256":"e4ac5c7fbb41ee988029b27d8b6be574725689fd1365f5a56f5a12d9120f86c6"},"Company":"Corsair Memory, Inc.","Copyright":"Corsair Memory, Inc. (c) 2019, All rights reserved","CreationTimestamp":"2019-10-28 19:19:22","Date":"","Description":"Corsair LL Access","ExportedFunctions":"","FileVersion":"1.0.18.0","Filename":"CorsairLLAccess64.sys","ImportedFunctions":["RtlInitUnicodeString","RtlGetVersion","KeInitializeMutex","KeReleaseMutex","KeWaitForSingleObject","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExInitializeNPagedLookasideList","ExDeleteNPagedLookasideList","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","wcsncmp","MmMapIoSpace","MmUnmapIoSpace","IoAllocateMdl","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoGetRequestorProcessId","__C_specific_handler","KeBugCheckEx","wcsncat_s","MmUnmapLockedPages","wcscpy_s","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"Corsair LL Access","MD5":"803a371a78d528a44ef8777f67443b16","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"Corsair LL Access","Product":"Corsair LL Access","ProductVersion":"1.0.18.0","Publisher":"","RichPEHeaderHash":{"MD5":"db4a4d1f55d69acf244fb7278f381f4d","SHA1":"a5ee4f58eb5c1091d35c894571d1c1d3ec096027","SHA256":"c7b0e867e0605a50d4db86a2de3b5af8451f84f8c3708e18267cb16fec877e18"},"SHA1":"5fb9421be8a8b08ec395d05e00fd45eb753b593a","SHA256":"000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b","Sections":{".text":{"Entropy":6.167927885696172,"Virtual Size":"0xf8a"},".rdata":{"Entropy":3.8995505502370675,"Virtual Size":"0x5ec"},".data":{"Entropy":0.28109187076190567,"Virtual Size":"0x380"},".pdata":{"Entropy":3.6266995207164214,"Virtual Size":"0xfc"},"INIT":{"Entropy":5.2475324615066405,"Virtual Size":"0x46c"},".rsrc":{"Entropy":3.494224562959288,"Virtual Size":"0x428"},".reloc":{"Entropy":2.5414460711655216,"Virtual Size":"0x14"}},"Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014","Microsoft Root Certificate Authority 2010"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2019-06-05 18:34:00","ValidTo":"2020-06-03 18:34:00","Signature":"312314217055afc1a5751181c7d2d7619b23ba17166e6ae6f358b16921c925c6e3b75c31b93035f357c154fe4d347019e927db1957193b741e3371b46f4d6212b3bec972d6ff2297e8b1f2391f840045471ee31c524d4f5bf1cae4a32b73f6e48f51f777bb5b8a726db2a387c7c8df42289540f4f3d27b37d4ab4854efba809021879f3257d5670d70003a51d62bbc68e345a769f37ccb3ad336b7b3c494f5d56ef8300228d29835e5129b070742a220f83b6c9d5e2589cf2e7a1f7b59cfc81cda3232fc2fa448d736db546dc4b274cad3da83433deaa3eb9919b23ad08dc4055a8026711adcfccdb47d7a7c1adb2671ecc7198a786973807699a0ee236a46771f88913b769693b0b8ce9b002a40c2aa426edfd9a98368f89817b0d174458a390e11628e21f77e751431fae13831228e0e357610a24d89806d85390e9b3831792f62688bf04f91ee9a854b252452de7e752f39e57765a09a4ff41ae96144593a8a99688c6c9ad6b9fcaba1189ef2372b99e96db3fe6402b0e125b17f36c6f70fc1eb83257ce639b6c691a9ec031dddb9fa6536bb8e6080c9db976533f4ddfb73309b6498543cc94d3283d43668d614dd60a4fe707eb3b871da3204c534c8cc73cbc66aeb36cefd765439eef68d7ee9c515eb617f051a72097d0a25003df2dceccc9a0c4be1fd27e473955cc83ee9dba626748b1cb723c3b1c8b8ebc59321a0f5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000319479a318f5522d06000000000031","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5b81fd0f706522a8d7c9f2957283c0b4","SHA1":"84d894599653a8ed0e0b2802db3197dc177908cc","SHA256":"4fa629304df4287c97ae5b7e481974316e9daf776b0cdeffab1671e7dca68fb4","SHA384":"0b89dc122fc7ebf80881a5047ffbbcb0bec30636516aff4f43307e2a925a476cabfc26e2cc392ad748d655f6ec4c8b75"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000319479a318f5522d06000000000031","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"f2c2ee1ff03c54f384f4eee8c2533107","LoadsDespiteHVCI":"TRUE"},{"Filename":"CorsairLLAccess64.sys","MD5":"31c74ebdf17f3cc1743cc5bea8ac2969","SHA1":"97bb69b286007fbf7fc49b00550d8c35123167f0","SHA256":"01e024d3c76fb1b71851ab7761afbee23159d6e8cbf7f5f1d5052efca2f7756d","Signature":"","Date":"","Publisher":"","Company":"Corsair Memory, Inc.","Description":"Corsair LL Access","Product":"Corsair LL Access","ProductVersion":"1.0.24.0","FileVersion":"1.0.24.0","MachineType":"AMD64","OriginalFilename":"Corsair LL Access","Authentihash":{"MD5":"65f9a906b0aa74f96499cf22b160b459","SHA1":"4b0ee799ab0c70d52d7f91b909b3af5e0b20baa9","SHA256":"254d4c61b2784ba2796fb0b5395d30ff9113e89ef1537f96a48ea50e2ba195c1"},"RichPEHeaderHash":{"MD5":"20828ab1c594c66acf9953ede3d9c31a","SHA1":"5d2bdeedb3a9f6227cef09cdd8aa3e6de4ff9e55","SHA256":"f35e6c177531561e7c941f53650218ed0d985b4883f9b94d0ab50a1c4765a261"},"Sections":{".text":{"Entropy":6.219306602777356,"Virtual Size":"0x104a"},".rdata":{"Entropy":3.943166366250597,"Virtual Size":"0x614"},".data":{"Entropy":0.28109187076190567,"Virtual Size":"0x348"},".pdata":{"Entropy":3.6001880437651934,"Virtual Size":"0xfc"},"INIT":{"Entropy":5.243509755740983,"Virtual Size":"0x4aa"},".rsrc":{"Entropy":3.490966666998869,"Virtual Size":"0x428"},".reloc":{"Entropy":2.7638651219508543,"Virtual Size":"0x14"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2020-02-13 22:40:22","InternalName":"Corsair LL Access","Copyright":"Corsair Memory, Inc. (c) 2020, All rights reserved","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","RtlGetVersion","KeInitializeMutex","KeReleaseMutex","KeWaitForSingleObject","ExFreePoolWithTag","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","ExInitializeNPagedLookasideList","ExDeleteNPagedLookasideList","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","wcsncmp","MmMapIoSpace","MmUnmapIoSpace","IoAllocateMdl","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","SeQueryInformationToken","IoGetRequestorProcessId","__C_specific_handler","KeBugCheckEx","wcsncat_s","MmUnmapLockedPages","wcscpy_s","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2019-06-05 18:34:00","ValidTo":"2020-06-03 18:34:00","Signature":"312314217055afc1a5751181c7d2d7619b23ba17166e6ae6f358b16921c925c6e3b75c31b93035f357c154fe4d347019e927db1957193b741e3371b46f4d6212b3bec972d6ff2297e8b1f2391f840045471ee31c524d4f5bf1cae4a32b73f6e48f51f777bb5b8a726db2a387c7c8df42289540f4f3d27b37d4ab4854efba809021879f3257d5670d70003a51d62bbc68e345a769f37ccb3ad336b7b3c494f5d56ef8300228d29835e5129b070742a220f83b6c9d5e2589cf2e7a1f7b59cfc81cda3232fc2fa448d736db546dc4b274cad3da83433deaa3eb9919b23ad08dc4055a8026711adcfccdb47d7a7c1adb2671ecc7198a786973807699a0ee236a46771f88913b769693b0b8ce9b002a40c2aa426edfd9a98368f89817b0d174458a390e11628e21f77e751431fae13831228e0e357610a24d89806d85390e9b3831792f62688bf04f91ee9a854b252452de7e752f39e57765a09a4ff41ae96144593a8a99688c6c9ad6b9fcaba1189ef2372b99e96db3fe6402b0e125b17f36c6f70fc1eb83257ce639b6c691a9ec031dddb9fa6536bb8e6080c9db976533f4ddfb73309b6498543cc94d3283d43668d614dd60a4fe707eb3b871da3204c534c8cc73cbc66aeb36cefd765439eef68d7ee9c515eb617f051a72097d0a25003df2dceccc9a0c4be1fd27e473955cc83ee9dba626748b1cb723c3b1c8b8ebc59321a0f5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000319479a318f5522d06000000000031","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5b81fd0f706522a8d7c9f2957283c0b4","SHA1":"84d894599653a8ed0e0b2802db3197dc177908cc","SHA256":"4fa629304df4287c97ae5b7e481974316e9daf776b0cdeffab1671e7dca68fb4","SHA384":"0b89dc122fc7ebf80881a5047ffbbcb0bec30636516aff4f43307e2a925a476cabfc26e2cc392ad748d655f6ec4c8b75"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000319479a318f5522d06000000000031","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"b1de401efd9d1c08f251d13cbbdf568d"}]}