Driver intelligenceVulnerableVerified

Afd.sys

Windows Ancillary Function Driver (Afd.sys) for WinSock is vulnerable to an Elevation of Privilege Vulnerability.

UUID / 394f49b2-2d78-4d0d-b374-1399695455f3ADDED / 2024-08-21AUTHOR / Nasreddine Bencherchali

Known samples 2

2 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Afd.sysSample 1 · HVCI TRUE

MD5: e2db558c3996bb34fbf21017f0ce5591
SHA1: 52e287860e0459362e4b655a75795e260eae2964
SHA256: ebf6be42d39fd5d9361afa43479f883ff8eba97d72f313ece289f78cb51c22f2
Imphash: b74b53dd1f82c21aab079d727e517ba4
Authentihash MD5: 6775bbd47a793d793bcaf0b114b242da
Authentihash SHA1: fb0b5d98d1add03004d612831b67353df994a189
Authentihash SHA256: a490a57a8f57ae27571629197bb652b0f4c84f9414d09bf6cfe2ee1b175101b4
Machine: AMD64
Version: 10.0.22621.1105 (WinBuild.160101.0800)
Publisher: Microsoft Corporation

Afd.sysSample 2 · HVCI TRUE

MD5: d9afa784f62d5a2c282074c90f220e35
SHA1: 479120a6b5ef38787d6929b3b3edcd3a46d34bd8
SHA256: 95fd266cc454177901cb58f4d30417c4a7caf29be62bb8649e5b8fca58823600
Imphash: b74b53dd1f82c21aab079d727e517ba4
Authentihash MD5: 6c74f578d1222a9ab04e944b9cf7efbb
Authentihash SHA1: 7aed7084ba413ec20e198af1e5d1c359e33ca87d
Authentihash SHA256: 765869c7c04b49e77de313806398472ec90dce45206a6d71e448d4e2e499715d
Machine: AMD64
Version: 10.0.22621.608 (WinBuild.160101.0800)
Publisher: Microsoft Corporation

sc.exe create Afd.sys binPath=C:\windows\temp\Afd.sys type=kernel && sc.exe start Afd.sys

Elevate privileges · Privileges: kernel · OS: Windows 10