← Back to driver explorer
Driver intelligenceVulnerableVerified
VdBSv64.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
VdBSv64.sysSample 1 · HVCI FALSE
- MD5
4353b713487a2945b823423bbbf709bd- SHA1
4ffa89f8dbdade28813e12db035cf9bd8665ef72- SHA256
91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4- Imphash
9523103b30fb194643b97ccc3ab7abb0- Authentihash MD5
16f4705fc75a0769f46b2d1745240aad- Authentihash SHA1
52da22f92d5d022eaae66ef9e5ebca7ef27b674d- Authentihash SHA256
d2da77e10d2fd2b8b2aa68ab4af1483ef270311c846644e0ec61ace146ee6feb- Machine
- AMD64
- Version
- 21, 1, 1, 0
- Publisher
- MiTAC Technology Corporation
Recorded command
sc.exe create VdBSv64sys binPath= C:\windows\temp\VdBSv64sys.sys type=kernel && sc.exe start VdBSv64sysElevate privileges · Privileges: kernel · OS: Windows 10