← Back to driver explorer
Driver intelligenceVulnerableVerified
Mhyprot2.sys
Description not recorded.
Known samples 10
2 recorded TRUE · 8 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
mhyprot.sysSample 1 · HVCI TRUE
- MD5
8b779fe1d71839ad361226f66f1b3fe5- SHA1
175fb76c7cd8f0aeb916f4acb3b03f8b2d51846a- SHA256
0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467- Imphash
a74f61fdcea718cb9579907b2caf54ab- Authentihash MD5
a74fbda962fe6aa9701b1af91f74675a- Authentihash SHA1
f1f4cfa7c5b4a882ff4c107e72977edcd7128855- Authentihash SHA256
7bfa54943180e34aea390a8f63a2cb007cf53c336dff697c60a79103f3c0c19d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot.sysSample 2 · HVCI TRUE
- MD5
67e3b720cee8184c714585a85f8058a0- SHA1
254dce914e13b90003b0ae72d8705d92fe7c8dd0- SHA256
69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2- Imphash
82525a4a571f0f8d4e4f42ec6bb3900e- Authentihash MD5
19c86f21ca10d68738fac94bb43e7861- Authentihash SHA1
c771ea59f075170e952c393cfd6fc784b265027c- Authentihash SHA256
39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.sysSample 3 · HVCI FALSE
- MD5
8f47af49c330c9fcf3451ad2252b9e04- SHA1
be797c91768ac854bd3b82a093e55db83da0cb11- SHA256
ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058- Imphash
ebb99842fa08915eb8b7f67d8dc7a13a- Authentihash MD5
5908564f34ef8fd94e9420c8f1af19bc- Authentihash SHA1
bd2c5fdae29b39de9f862455fb2fb07fbf99ece2- Authentihash SHA256
df3fd9fa267e12d7c6b65028373e21978041f0c94375b5c7316498fbad6f4ae0- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.sysSample 4 · HVCI FALSE
- MD5
89c7bd12495e29413038224cb61db02e- SHA1
16c6bcef489f190a48e9d3b1f35972db89516479- SHA256
b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418- Imphash
4b0b017b23567cf8b9e1268957acd032- Authentihash MD5
d5a852a9cb4c81cba921aaf523bcabf4- Authentihash SHA1
a3fd0d15889398830a61eed9dfac17dfbde792ef- Authentihash SHA256
8ced17d1ee92ae72749afdfe40f5029223d97f0f977e718bd5ab1242d1ff7cb5- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Mhyprot2.sysSample 5 · HVCI FALSE
- MD5
4b817d0e7714b9d43db43ae4a22a161e- SHA1
0466e90bf0e83b776ca8716e01d35a8a2e5f96d3- SHA256
509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6- Imphash
a74f61fdcea718cb9579907b2caf54ab- Authentihash MD5
ff295de93e6b6dcc3938d50901a7240d- Authentihash SHA1
484c72dd4fd91083b249f3ccc733a3c8335e583f- Authentihash SHA256
0c7809ac1fa074408518ddc0ac118912c9cd43ed9c89213bc4d59043016b040c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.sysSample 6 · HVCI FALSE
- MD5
6b2df08bacf640cc2ac6f20c76af07ee- SHA1
2c2fc258871499b206963c0f933583cedcdf9ea2- SHA256
26d69e677d30bb53c7ac7f3fce76291fe2c44720ef17ee386f95f08ec5175288- Imphash
5095ddaed3abc22c1510a141d72735cc- Authentihash MD5
0abb783d69d8120a232f3be1411b9f79- Authentihash SHA1
dcf13f12b2429a0a50e0094776b59bea641b142c- Authentihash SHA256
000e984d3eebc54259a24a17745eed07d9c3658b86462cb5ebc26381302f7a38- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.sysSample 7 · HVCI FALSE
- MD5
d717f8de642b65f029829c34fbd13a45- SHA1
296757d5663290f172e99e60b9059f989cba4c4e- SHA256
46cf46e1073b7c99142964b7c4bef1e5285fabcf2c6dbe5be99000a393d9f474- Imphash
ebb99842fa08915eb8b7f67d8dc7a13a- Authentihash MD5
6f769353f497a9f17430d02ff1291281- Authentihash SHA1
f408ad59f7590d26afc84a7109dd56cfe98ebea9- Authentihash SHA256
dbcad271feda00f614ef9866886cde83e9fffac6e76694fd052790541bb7e993- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.SysSample 8 · HVCI FALSE
- MD5
a2c5f994e9b4a74b2f5b51c7a44c4401- SHA1
6210dabb908cc750379cc7563beb884b3895e046- SHA256
247aadaf17ed894fcacf3fc4e109b005540e3659fd0249190eb33725d3d3082f- Imphash
409d2ab916237fb129c57aacbb7cb4fe- Authentihash MD5
372e018ebaa20ffbd474b39c3d97fba9- Authentihash SHA1
05234d1a267c9b6c1754272658fbebb22633cac0- Authentihash SHA256
faa37602095f25135312f87ed7adb607ffa5e9b2931b58d00f7376ed0c6ec69a- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.SysSample 9 · HVCI FALSE
- MD5
9c8fffef24fc480917236f9a20b80a47- SHA1
35a817d949b2eab012506bed0a3b4628dd884471- SHA256
6e76764d750ebd835aa4bb055830d278df530303585614c1dc743f8d5adf97d7- Imphash
4b0b017b23567cf8b9e1268957acd032- Authentihash MD5
0bf04830652ccd02dca462c6f965b678- Authentihash SHA1
8e6248135ad596861d8f6d42703deb79382f285a- Authentihash SHA256
f18605a691056b446c6411b7fa841b8178059bde8094cfe9013e59f4663cdf7f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
mhyprot2.sysSample 10 · HVCI FALSE
- MD5
dc358c301fb463c2f4e7edb028dfe7e8- SHA1
8f8a0b813ada9886d2d32fc41b74fb5c3a32177d- SHA256
342cf884840fc2b48c96398f690a1801ed8ac1ea59305af9e3d070d13ef85601- Imphash
a74f61fdcea718cb9579907b2caf54ab- Authentihash MD5
ff295de93e6b6dcc3938d50901a7240d- Authentihash SHA1
484c72dd4fd91083b249f3ccc733a3c8335e583f- Authentihash SHA256
0c7809ac1fa074408518ddc0ac118912c9cd43ed9c89213bc4d59043016b040c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create mhyprot.sys binPath=C:\windows\temp\mhyprot.sys type=kernel && sc.exe start mhyprot.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/namazso/physmem_drivers
- https://github.com/jbaines-r7/dellicious
- https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
- https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Mhyprot.yar
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
- https://github.com/kagurazakasanae/Mhyprot2DrvControl/tree/main