39f427b6-aad3-4cb8-b363-9113a6d53b07

BS_RCIOW1064.sys :inline

Description

BS_RCIOW1064.sys is a vulnerable driver and more information will be added as found.

  • UUID: 39f427b6-aad3-4cb8-b363-9113a6d53b07
  • Created: 2023-05-06
  • Author: Nasreddine Bencherchali
  • Acknowledgement: |

Download

This download link contains the vulnerable driver!

Commands

sc.exe create BS_RCIOW1064.sys binPath=C:\windows\temp\BS_RCIOW1064.sys type=kernel && sc.exe start BS_RCIOW1064.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • Internal Research

    • Known Vulnerable Samples

    PropertyValue
    FilenameBS_RCIOW1064.sys
    Creation Timestamp2017-04-17 02:48:21
    MD56b6dfb6d952a2e36efd4a387fdb94637
    SHA142eb220fdfb76c6e0649a3e36acccbdf36e287f1
    SHA2566191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc
    Authentihash MD5aa8a043ec2d13570a43af8e09d4adf4f
    Authentihash SHA13c8cab4c08a37a105200feb8f07dd818c8f03bff
    Authentihash SHA256545190e8b2a910e153b12559a9875154a1b40d6424cb4a6299a84b2dc99df700
    RichPEHeaderHash MD59e4425704fab855e1d15d14884b50fc4
    RichPEHeaderHash SHA1fc1001bb82b6e079b79ce69deb28d7e2c44b50d7
    RichPEHeaderHash SHA256b5dd410353c4011fe699e4a824a89792144f5a11c756f64d5b5acfea3a9f1c8a

    Download

    Certificates

    Expand
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 0293728e6275aee2cea6efb4bac1eed6
    FieldValue
    ToBeSigned (TBS) MD5fceeb2776d11b95aa3245d3d58f42b1c
    ToBeSigned (TBS) SHA14f7372c5af343d7b826a3850efc89890dc925e89
    ToBeSigned (TBS) SHA2567e415ade909c99a1a1b34400f1c6e4e7c6e1fc6b878db11b5e18232248ede0e1
    Subject??=Private Organization, ??=TW, serialNumber=23826200, ??=2F, NO.108,2, MIN CHUAN RD, postalCode=231, C=TW, ST=XINDIAN DIST, L=NEW TAIPEI CITY, O=Biostar Microtech Int'l Corp, CN=Biostar Microtech Int'l Corp
    ValidFrom2017-03-03 00:00:00
    ValidTo2018-11-21 12:00:00
    Signature4bf4d2bdc69b9a5453f71bf6c52ac1fb1624d21a1bf7f195d72f2e45e91b57dcd3ad76e4acd2ca278673867cc2d3f9bfb19f0a02c28abe5972f81ac12928fe9e340a53a198a8b106f0925defe5d11f077380a467d7a529c0037d25f526e131d63cee3b64727330eacc9e2fe328912803f2449652840778c8b663102b01a6eacddd2364b85ede2696131189edeb65f2228345ff1d31b91de4763c4a91e8c643717ad09db26da7cda6b39559f5953c3172afc8c627eea22dd47b88d32f32640a4679ba84ac4434e5c53de60d802344fa066a7d7da0b109b241559013ec8c630400c2f8c631d09e49da7b025f4b91a1fae12c65682556570ca4faaca645f6d5ee69
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber0293728e6275aee2cea6efb4bac1eed6
    Version3
    Certificate 03f1b4e15f3a82f1149678b3d7d8475c
    FieldValue
    ToBeSigned (TBS) MD583f5de89f641d0fbf60248e10a7b9534
    ToBeSigned (TBS) SHA1382a73a059a08698d6eb98c87e1b36fc750933a4
    ToBeSigned (TBS) SHA256eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber03f1b4e15f3a82f1149678b3d7d8475c
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • KeInitializeSemaphore
    • IoCreateSymbolicLink
    • IoCreateDevice
    • KeSetEvent
    • MmUnmapIoSpace
    • KeDelayExecutionThread
    • PsCreateSystemThread
    • IoStartNextPacket
    • PsTerminateSystemThread
    • ExEventObjectType
    • MmMapIoSpace
    • IoDeleteDevice
    • ObReferenceObjectByHandle
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • ObfDereferenceObject
    • IoReleaseCancelSpinLock
    • IoAcquireCancelSpinLock
    • IoStartPacket
    • IofCompleteRequest
    • KeRemoveEntryDeviceQueue
    • KeBugCheckEx
    • RtlInitUnicodeString
    • ZwClose
    • IoDeleteSymbolicLink
    • HalSetBusDataByOffset
    • HalGetBusDataByOffset

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT

    Signature

    Expand
    {
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "61204db4000000000027",
      "Signature": "208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA",
      "TBS": {
        "MD5": "8e3ffc222fbcebdbb8b23115ab259be7",
        "SHA1": "ee20bff28ffe13be731c294c90d6ded5aae0ec0e",
        "SHA256": "59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821",
        "SHA384": "f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"
      },
      "ValidFrom": "2011-04-15 19:45:33",
      "ValidTo": "2021-04-15 19:55:33",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0293728e6275aee2cea6efb4bac1eed6",
      "Signature": "4bf4d2bdc69b9a5453f71bf6c52ac1fb1624d21a1bf7f195d72f2e45e91b57dcd3ad76e4acd2ca278673867cc2d3f9bfb19f0a02c28abe5972f81ac12928fe9e340a53a198a8b106f0925defe5d11f077380a467d7a529c0037d25f526e131d63cee3b64727330eacc9e2fe328912803f2449652840778c8b663102b01a6eacddd2364b85ede2696131189edeb65f2228345ff1d31b91de4763c4a91e8c643717ad09db26da7cda6b39559f5953c3172afc8c627eea22dd47b88d32f32640a4679ba84ac4434e5c53de60d802344fa066a7d7da0b109b241559013ec8c630400c2f8c631d09e49da7b025f4b91a1fae12c65682556570ca4faaca645f6d5ee69",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "??=Private Organization, ??=TW, serialNumber=23826200, ??=2F, NO.108,2, MIN CHUAN RD, postalCode=231, C=TW, ST=XINDIAN DIST, L=NEW TAIPEI CITY, O=Biostar Microtech Int\u0027l Corp, CN=Biostar Microtech Int\u0027l Corp",
      "TBS": {
        "MD5": "fceeb2776d11b95aa3245d3d58f42b1c",
        "SHA1": "4f7372c5af343d7b826a3850efc89890dc925e89",
        "SHA256": "7e415ade909c99a1a1b34400f1c6e4e7c6e1fc6b878db11b5e18232248ede0e1",
        "SHA384": "9da446ae9f73a8c0954d0bb9d3a24895562ec7f6e8addc405a3195aea3a8274a54761987fff22d2ac97a306410588895"
      },
      "ValidFrom": "2017-03-03 00:00:00",
      "ValidTo": "2018-11-21 12:00:00",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "03f1b4e15f3a82f1149678b3d7d8475c",
      "Signature": "19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)",
      "TBS": {
        "MD5": "83f5de89f641d0fbf60248e10a7b9534",
        "SHA1": "382a73a059a08698d6eb98c87e1b36fc750933a4",
        "SHA256": "eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf",
        "SHA384": "4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"
      },
      "ValidFrom": "2012-04-18 12:00:00",
      "ValidTo": "2027-04-18 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)",
      "SerialNumber": "0293728e6275aee2cea6efb4bac1eed6",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2024-04-09