722772ee-a461-48ec-933d-f3df1578963e

BlackBoneDrv10.sys

We were not able to verify the hash of this driver successfully, it has not been confirmed.

Description

BlackBoneDrv10.sys is a vulnerable driver and more information will be added as found.

UUID: 722772ee-a461-48ec-933d-f3df1578963e
Created: 2023-01-09
Author: Michael Haag
Acknowledgement: |

This download link contains the vulnerable driver!

Commands

sc.exe create BlackBoneDrv10.sys binPath=C:\windows\temp\BlackBoneDrv10.sys     type=kernel &amp;&amp; sc.exe start BlackBoneDrv10.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

Known Vulnerable Samples

Property	Value
Filename	BlackBoneDrv10.sys
Creation Timestamp	2020-08-22 02:28:52
MD5	f7393fb917aed182e4cbef25ce8af950
SHA1	3ee2fd08137e9262d2e911158090e4a7c7427ea0
SHA256	f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960
Authentihash MD5	068d02b18a4c87366e8d54200f319e50
Authentihash SHA1	79ef55ea5d6cab924abb722d501e9b950fdae904
Authentihash SHA256	a4ac619fb531793945ad4c72bdd809ebd38512fc234aa452cb8364ee05465a7b
RichPEHeaderHash MD5	8ae03f4a21c195de4eeb96ec5dae9b7a
RichPEHeaderHash SHA1	93e1d3ff812963175c270d4f8c23c6cface99c06
RichPEHeaderHash SHA256	d372fd5e9e55f5a8a5719a0691ead276968e1666719a27dcc6967d4f745dfd6d

Download

Certificates

Expand

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 20e65f5d29b5822410504b1ac183ca3d

Field	Value
ToBeSigned (TBS) MD5	8219b89810131cf32fbe06e74b40f51f
ToBeSigned (TBS) SHA1	f5e1c4d98f9ce552ead3776c16f3ad91fe5f3984
ToBeSigned (TBS) SHA256	82d80ae75a0d82b17f868b4400e7f0139954c8b42d529cb4126f49bc64b01fab
Subject	C=CN, ST=Jiangsu, L=Nanjing, O=Nanjing Zhixiao Information Technology Co.,Ltd, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Nanjing Zhixiao Information Technology Co.,Ltd
ValidFrom	2013-11-14 00:00:00
ValidTo	2014-11-14 23:59:59
Signature	88a030b879440999e5a66689adae51847fe59596574be2288fb361a7e5b00229efe74d69db86c75590c5e826c268678647664010a9e9c710e4aa4c6b2f6f6a3b9f7530664feae19ab86797591da69186ab36046efbe764c6e17eff1444a78ef3df601a66614e80d30b2447ed7224fdede1ac5aaa8baa0165fdc8382e344f7dcc6a18fb6b621d47076bf1f7d639a36fc494163633c431a404e75fa34097c9e378e2db12299f9579bbcf9bf27a76d66ecfbefcce02c97f5c53487885a4768daba930de4fcf6952f30b466fa454c01983345de51c11eb6bafc45881b66d26d0ee4eec1b7096f0b63c2b1a440077a71b4ff26e543601c0a2e00f648957c04aa8a8a0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	20e65f5d29b5822410504b1ac183ca3d
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlUnicodeStringToInteger
RtlInitAnsiString
DbgPrintEx
RtlGetVersion
KeInitializeGuardedMutex
ExAllocatePoolWithTag
ExFreePoolWithTag
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ZwClose
ZwOpenKey
ZwQueryValueKey
RtlInitializeGenericTableAvl
RtlCompareString
PsSetCreateProcessNotifyRoutine
RtlImageNtHeader
IofCompleteRequest
RtlInitUnicodeString
KeDelayExecutionThread
ProbeForRead
IoGetCurrentProcess
ObfDereferenceObject
KeStackAttachProcess
KeUnstackDetachProcess
PsIsThreadTerminating
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsGetProcessWow64Process
PsIsProtectedProcess
ZwProtectVirtualMemory
__C_specific_handler
RtlImageDirectoryEntryToData
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlAppendUnicodeToString
RtlFreeUnicodeString
KeWaitForSingleObject
MmMapLockedPagesSpecifyCache
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
PsWrapApcWow64Thread
ObReferenceObjectByHandle
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
PsGetCurrentThreadId
PsGetProcessId
PsLookupThreadByThreadId
ZwWaitForSingleObject
ZwQuerySystemInformation
ZwQueryInformationThread
PsGetProcessPeb
PsGetThreadTeb
PsGetCurrentProcessWow64Process
KeTestAlertThread
KeInitializeApc
KeInsertQueueApc
PsThreadType
RtlCopyUnicodeString
KeResetEvent
ZwWriteFile
RtlRandomEx
RtlCreateUnicodeString
RtlDowncaseUnicodeString
ZwCreateEvent
ZwDeleteFile
ZwQueryInformationProcess
_vsnwprintf
ExEventObjectType
KeAcquireGuardedMutex
KeReleaseGuardedMutex
MmGetSystemRoutineAddress
RtlCaptureContext
KeCapturePersistentThreadState
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
ObCloseHandle
ZwOpenFile
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableAvl
RtlIsGenericTableEmptyAvl
PsGetCurrentProcessId
ZwQueryVirtualMemory
MmHighestUserAddress
MmCopyVirtualMemory
ExEnumHandleTable
ExfUnblockPushLock
RtlCompareUnicodeStrings

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "20e65f5d29b5822410504b1ac183ca3d",
      "Signature": "88a030b879440999e5a66689adae51847fe59596574be2288fb361a7e5b00229efe74d69db86c75590c5e826c268678647664010a9e9c710e4aa4c6b2f6f6a3b9f7530664feae19ab86797591da69186ab36046efbe764c6e17eff1444a78ef3df601a66614e80d30b2447ed7224fdede1ac5aaa8baa0165fdc8382e344f7dcc6a18fb6b621d47076bf1f7d639a36fc494163633c431a404e75fa34097c9e378e2db12299f9579bbcf9bf27a76d66ecfbefcce02c97f5c53487885a4768daba930de4fcf6952f30b466fa454c01983345de51c11eb6bafc45881b66d26d0ee4eec1b7096f0b63c2b1a440077a71b4ff26e543601c0a2e00f648957c04aa8a8a0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Jiangsu, L=Nanjing, O=Nanjing Zhixiao Information Technology Co.,Ltd, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Nanjing Zhixiao Information Technology Co.,Ltd",
      "TBS": {
        "MD5": "8219b89810131cf32fbe06e74b40f51f",
        "SHA1": "f5e1c4d98f9ce552ead3776c16f3ad91fe5f3984",
        "SHA256": "82d80ae75a0d82b17f868b4400e7f0139954c8b42d529cb4126f49bc64b01fab",
        "SHA384": "f635a792b1fb34fe16b37ab3db2808ce1d286620241239204b31299366b68015957f103ccb6a502a5aaff0094157c8e1"
      },
      "ValidFrom": "2013-11-14 00:00:00",
      "ValidTo": "2014-11-14 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "20e65f5d29b5822410504b1ac183ca3d",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-04-09