← Back to driver explorer
Driver intelligenceVulnerableVerified
rtif.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 7
0 recorded TRUE · 7 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
rtif.sysSample 1 · HVCI FALSE
- MD5
a15235fcec1c9b65d736661d4bec0d38- SHA1
3c956b524e73586195d704b874e36d49fe42cb6a- SHA256
0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180- Imphash
3e8e7e5e779c7064e6bab177167e9e7a- Authentihash MD5
923686e31f947b09e375b0ff00ee04ee- Authentihash SHA1
efec1e9d398ace84337c6c47cb6faabf25306f61- Authentihash SHA256
42b528fdde50a21afed0cbdc07a6cb9d22d421eb0228d4782f18d22a83873223- Machine
- AMD64
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 2 · HVCI FALSE
- MD5
1873a2ce2df273d409c47094bc269285- SHA1
f049e68720a5f377a5c529ca82d1147fe21b4c33- SHA256
3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76- Imphash
d61d30746681d0fda9bfd9e8af061b2a- Authentihash MD5
7af3a3a48cb2049abc8c62efcd984bd0- Authentihash SHA1
f679711f5625ce95c6ebaaf554e9c26d89db0564- Authentihash SHA256
f46c524b79b9b1eb7efd5275dd1604de94560b52edca70ba4e47037f4b55da47- Machine
- I386
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 3 · HVCI FALSE
- MD5
112b4a6d8c205c1287c66ad0009c3226- SHA1
0caf4e86b14aaab7e10815389fcd635988bc6637- SHA256
4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0- Imphash
c12f7aec6ebe84a8390c82720adfc237- Authentihash MD5
e6dc1afaf3f32d09e92e237291b0e634- Authentihash SHA1
7c594957e490db58473132f699b4bac82f4928ed- Authentihash SHA256
ba6c0c9b64fa739158b5f4465d53e67e574e4b954c8e143cf4e299f5daa65b60- Machine
- AMD64
- Version
- 420 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 4 · HVCI FALSE
- MD5
35fbc4c04c31c1a40e666be6529c6321- SHA1
f130e82524d8f5af403c3b0e0ffa4b64fedeec92- SHA256
9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727- Imphash
c61a46ffe79d3f7d6307c0d2ae5f391e- Authentihash MD5
290543f10941cfee914bdd8dda18265b- Authentihash SHA1
d5ecb45182c0abe8797cd44811e8149728c3be88- Authentihash SHA256
c662ed197a5849cf491ee099885f8855b4f8a3d0f5b664c772f2b89c0314b44e- Machine
- AMD64
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 5 · HVCI FALSE
- MD5
6c5e50ef2069896f408cdaaddd307893- SHA1
8d676504c2680cf71c0c91afb18af40ea83b6c22- SHA256
a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e- Imphash
e1d88d0526dfa369c3661355dbd8773d- Authentihash MD5
e8e61cae63a99c97074c083bca2b4231- Authentihash SHA1
2ab81656c1eece7b9b05e0d28257acdca216336a- Authentihash SHA256
a2dee316cd07963c2eb7ebb1b4189eca78786c835aaafeb6467b37c1353d821a- Machine
- I386
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 6 · HVCI FALSE
- MD5
4b42a7a6327827a8dbdecf367832c0cd- SHA1
ce1d0ebaeaa4fe3ecb49242f1e80bc7a4e43fd8c- SHA256
ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d- Imphash
3e8e7e5e779c7064e6bab177167e9e7a- Authentihash MD5
41cb3bf0ce126d2e909ef8918312578c- Authentihash SHA1
54bed9a75d950714920d1415be6e273c0ac987e4- Authentihash SHA256
19595c3de596f8b705eef1b135768d3051305698ceed083401f8acfba4bd5393- Machine
- AMD64
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
rtif.sysSample 7 · HVCI FALSE
- MD5
ff795e4f387c3e22291083b7d6b92ffb- SHA1
5eb693c9cc49c7d6a03f7960ddcfd8f468e5656b- SHA256
eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed- Imphash
3d42ff70269b824dd9d4a8cb905669f9- Authentihash MD5
0a889f7961b83dc1d637bcc92560074b- Authentihash SHA1
0e4691a2e125f4f61f37654252cd46bba76d9987- Authentihash SHA256
c9aeead632435bda4f5723fff5c48dc60451072bfc8649f2ad6e066ca910934a- Machine
- AMD64
- Version
- 500 built by: WinDDK
- Publisher
- TenAsys Corporation
Recorded command
sc.exe create rtifsys binPath= C:\windows\temp\rtifsys.sys type=kernel && sc.exe start rtifsysElevate privileges · Privileges: kernel · OS: Windows 10