Driver intelligenceVulnerableVerified

gdrv.sys

gdrv.sys is vulnerable to multiple CVEs: CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321. Read/Write Physical memory, read/write to/from IO ports, exposes ring0 memcpy-like functionality, read and write Machine Specific Registers (MSRs). Affected versions: GIGABYTE APP Center v1.05.21 and previous, AORUS GRAPHICS ENGINE v1.33 and previous, XTREME GAMING ENGINE v1.25 and previous, OC GURU II v2.08

UUID / 2bea1bca-753c-4f09-bc9f-566ab0193f4aADDED / 2023-01-09AUTHOR / Michael Haag, rasta-mouse, goosvorbook

Known samples 3

0 recorded TRUE · 3 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

gdrv.sysSample 1 · HVCI FALSE

MD5: 9ab9f3b75a2eb87fafb1b7361be9dfb3
SHA1: fe10018af723986db50701c8532df5ed98b17c39
SHA256: 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427
Imphash: cc81a908891587ccac8059435eda4c66
Authentihash MD5: b18b1bff521337695d2d6a0768340252
Authentihash SHA1: 0f5034fcf5b34be22a72d2ecc29e348e93b6f00f
Authentihash SHA256: 9c0e80958b907c8df345ec2f8d711acefb4951ee3e6e84892ecd429f5e1f3acb
Machine: AMD64
Version: 5.2.3790.1830 built by: WinDDK
Publisher: Windows (R) Server 2003 DDK provider

Download vulnerable sample ↗View on VirusTotal ↗

gdrv.sysSample 2 · HVCI FALSE

MD5: 1cff7b947f8c3dea1d34dc791fc78cdc
SHA1: 8d59fd14a445c8f3f0f7991fa6cd717d466b3754
SHA256: ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339
Imphash: 1d774a94ad511efe5ebfe70acc6f8c85
Authentihash MD5: bf45a5d10968424666abede02113a509
Authentihash SHA1: 5c26f130f6a5ad8bdd2eed29140542dae0885b17
Authentihash SHA256: 34da66774ba09c4a8fc59349401ca1fefaaf4e66a9c620c7782c072a16089ba3
Machine: AMD64
Version: 1.0.0.1
Publisher: GIGA-BYTE TECHNOLOGY CO., LTD.

Download vulnerable sample ↗View on VirusTotal ↗

gdrv.sysSample 3 · HVCI FALSE

MD5: 95a95e28cf5ee4ece6ffbaf169358192
SHA1: 84341ed15d645c4daedcdd39863998761e4cb0e3
SHA256: 88992ddcb9aaedb8bfcc9b4354138d1f7b0d7dddb9e7fcc28590f27824bee5c3
Imphash: cc81a908891587ccac8059435eda4c66
Authentihash MD5: b18b1bff521337695d2d6a0768340252
Authentihash SHA1: 0f5034fcf5b34be22a72d2ecc29e348e93b6f00f
Authentihash SHA256: 9c0e80958b907c8df345ec2f8d711acefb4951ee3e6e84892ecd429f5e1f3acb
Machine: AMD64
Version: 5.2.3790.1830 built by: WinDDK
Publisher: Windows (R) Server 2003 DDK provider

Download vulnerable sample ↗View on VirusTotal ↗

Recorded command

sc.exe create gdrv.sys binPath=C:\windows\temp\gdrv.sys type=kernel && sc.exe start gdrv.sys

Elevate privileges, tamper with PPL or system processes · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: MattNotMax @mattnotmax