← Back to driver explorer
Driver intelligenceVulnerableVerified
IMFForceDelete
IObit Malware Fighter IMFForceDelete.sys is a vulnerable force-delete filter driver. ESET documents GentleKiller's Cleaner variant dropping this driver without the trailing .sys extension, and CVE-2019-6494 describes IOCTL 0x8016E000 allowing low-privileged users to delete files regardless of access controls.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
IMFForceDelete.sysSample 1 · HVCI unknown
- MD5
75590850346c74a95d505ea3f8ff4a75- SHA1
12500f6c87ce62712a0ed6652c57468d15c14223- SHA256
ef4e4b88df24825dbf4e7131e71a41002715d38b7a8c0c432aa936c854152ef3- Imphash
7816745e971bb8da69822ba11f0b6c0c- Authentihash MD5
91745beee76b54a6e5101c031c03833b- Authentihash SHA1
58118cdd342ebd74ec8bef20ad2da155d2d701fd- Authentihash SHA256
f003c8abf8a692de770eb3bb8babec8c72f836d856f9c96f4de30e3ab47fea0f- Machine
- AMD64
- Version
- 7.0.0.5 built by: WinDDK
- Publisher
- IObit
Recorded command
sc.exe create IMFForceDelete binPath=C:\windows\temp\IMFForceDelete.sys type=kernel && sc.exe start IMFForceDeleteDelete protected files and impair defenses through a vulnerable kernel driver. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
- https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/ ↗
- https://www.eset.com/us/about/newsroom/research/eset-research-gentlemen-ransomware-gang-edr-killers/ ↗
- https://github.com/magicsword-io/LOLDrivers/issues/377 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2019-6494 ↗
- https://github.com/advisories/GHSA-rj7p-8gjh-5gqf ↗
Acknowledgement: ESET Research, 0xd3vnull @ESETresearch, @0xd3vnull