← Back to driver explorer
Driver intelligenceVulnerableVerified
RadHwMgr.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 6
2 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
RadHwMgr.sysSample 1 · HVCI TRUE
- MD5
048549f7e9978aff602a24dea98ee48a- SHA1
472cc191937349a712aabcbc4d118c1c982ab7c9- SHA256
00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c- Imphash
cc88330f6dca52a40e258f689d3e2db4- Authentihash MD5
baaf9c8dfdaf03f0e280ddf06061ba5b- Authentihash SHA1
8b460b62a12db011c7602f0d4a7145fa28c0b75c- Authentihash SHA256
be62ed235421930c84ce9c7789f3beb6b7a48a6bca9065063b7ce78effde1db2- Machine
- I386
- Version
- 3.1.0.22 built by: WinDDK
- Publisher
- Radiant Systems, Inc.
RadHwMgr.sysSample 2 · HVCI FALSE
- MD5
30550db8f400b1e11593dffd644abb67- SHA1
c31049605f028a56ce939cd2f97c2e56c12d99f8- SHA256
0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0- Imphash
7abb0911ca4cc4697ee1e9897932d3ac- Authentihash MD5
442c6809d9d2cfea4c12df554c21fa52- Authentihash SHA1
86e92cafe050d6ab258ddc828a3ffc3e0c5bec5f- Authentihash SHA256
5074f17c7cc4fdabec65b3b07132425ad0d9fefd993e896baba2f97f16277581- Machine
- I386
- Version
- 2.20.0.7 built by: WinDDK
- Publisher
- Radiant Systems, Inc.
RadHwMgr.sysSample 3 · HVCI TRUE
- MD5
f80ceb0dbb889663f0bee058b109ce0e- SHA1
a809831166a70700b59076e0dbc8975f57b14398- SHA256
7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f- Imphash
c1ab6741cd29de98a138f2bd639f620a- Authentihash MD5
860d15f6aeb63343a73c093e4937303f- Authentihash SHA1
67d6ef20f45720baa689b80c289a2908a8b63d2d- Authentihash SHA256
66a9052d6b1d35147f581249f6b524d8cab0b7c6ff80f621a4481f43db462540- Machine
- I386
- Version
- 9.9.0.1 built by: WinDDK
- Publisher
- Radiant Systems, Inc.
RadHwMgr.sysSample 4 · HVCI FALSE
- MD5
d4a9f80ecb448da510e5bf82c4a699ee- SHA1
091a039f5f2ae1bb0fa0f83660f4c178fd3a5a10- SHA256
7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc- Imphash
0c959096cf4b3180530cc7865ef29157- Authentihash MD5
e0ed4c5de74ee4b3a3eb93ec1bec6641- Authentihash SHA1
c4285308befc60b3f6500b34534b2d5fc253d38d- Authentihash SHA256
da5e27b18d3c1403975a8e17431242f208621348264ebe770db8b07813a1a0f8- Machine
- I386
- Version
- 2.33.0.0 built by: WinDDK
- Publisher
- NCR Corporation
RadHwMgr.sysSample 5 · HVCI FALSE
- MD5
f36b8094c2fbf57f99870bfaeeacb25c- SHA1
c4454a3a4a95e6772acb8a3d998b78a329259566- SHA256
903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b- Imphash
ced7ea67fdf3d89a48849e0062278f7d- Authentihash MD5
750aee72c5954cc95d596310f814ada7- Authentihash SHA1
ff9e5f196b16c49e9ac0e7004f815a39ef5e3397- Authentihash SHA256
a60d45d46e5a3dda02f41d20e5782135dd0da42c75eb9c39307bd67a7c9152ea- Machine
- AMD64
- Version
- 2.20.0.7 built by: WinDDK
- Publisher
- Radiant Systems, Inc.
RadHwMgr.sysSample 6 · HVCI FALSE
- MD5
2580fb4131353ec417b0df59811f705c- SHA1
de2c073c8b4db6ffd11a99784d307f880444e5d3- SHA256
df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858- Imphash
aca7bbc6be02770c50b07eb6f94d1d78- Authentihash MD5
66109ba4eaff3279c0420053192bbdc7- Authentihash SHA1
21bc11d6fe4ecee29fe9c0d09717c230fef8bf5a- Authentihash SHA256
ba386547523c5779e47c59ccb1b853918386cd398f054ac767a3a5b333e3fad3- Machine
- AMD64
- Version
- 0.0.0.2 Dev built by: WinDDK
- Publisher
- NCR Corporation
Recorded command
sc.exe create RadHwMgrsys binPath= C:\windows\temp\RadHwMgrsys.sys type=kernel && sc.exe start RadHwMgrsysElevate privileges · Privileges: kernel · OS: Windows 10