← Back to driver explorer
Driver intelligenceVulnerableVerified

KfeCo11X64.sys

Killer exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think that Killer suite is required for the NIC to work properly, so they install it even after a fresh Windows install. This version is confirmed vulnerable based on the script usage from zwclose.

UUID / 76b5dfae-b384-45ce-8646-b2eec6b76a1eADDED / 2023-05-12AUTHOR / Paul Michaud

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

KfeCo11X64.sysSample 1 · HVCI TRUE
MD5
c901887f28bbb55a10eb934755b47227
SHA1
2540205480ea3d59e4031de3c6632e3ce2596459
SHA256
9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba
Imphash
13300d56528646611f26704266713952
Authentihash MD5
758090532f58b19865d76a41389c2d58
Authentihash SHA1
6aa5070d7346f164d618915d32ddb9cfe1c1fecc
Authentihash SHA256
a7047cee090ddbd150d7337a9357e03ccea56f004a2d29ddb7b8a0636a396240
Machine
AMD64
Version
9.8.4.59
Publisher
Rivet Networks, LLC.

Recorded command

sc.exe create KfeCo11X64.sys binPath=C:\windows\temp\KfeCo11X64.sys type=kernel && sc.exe start KfeCo11X64.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: zwclose zwclose