← Back to driver explorer
Driver intelligenceVulnerableVerified
rtport.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 8
5 recorded TRUE · 3 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
rtport.sysSample 1 · HVCI FALSE
- MD5
41ce6b172542a9a227e34a45881e1d2a- SHA1
dd2b90c9796237036ac7136a172d96274dea14c8- SHA256
3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8- Imphash
87842ffa59724bda8389394bcaeb5d73- Authentihash MD5
cb185e6027fd0f1bf0e00657aea623a8- Authentihash SHA1
f61d01c700cdd2ad50ae7fd5b1f017a216efb46d- Authentihash SHA256
31add0358eb679d7c10ac1622403a85891bf764154280a589e71ccd297fc7a16- Machine
- I386
- Version
- 5.0.2195.1711
- Publisher
- Windows (R) 2003 DDK 3790 provider
rtport.sysSample 2 · HVCI TRUE
- MD5
782f165b1d2db23f78e82fee0127cc14- SHA1
717669a1e2380cb61cc4e34618e118cc9cabbcd0- SHA256
6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0- Imphash
8b41eacbfbe5f5348579e27d30767e74- Authentihash MD5
b4c4aace0c7a95285c71409310e9d5bd- Authentihash SHA1
daf2e7e6d8b811ce52de19e239cce1a1b94cb6e0- Authentihash SHA256
c3db6290145dc8905c0f97e218e0ef071f435a6ffaf1ed4c0699605d9a540038- Machine
- I386
- Version
- 5.00.2195.1620
- Publisher
- Windows (R) 2000 DDK provider
rtport.sysSample 3 · HVCI FALSE
- MD5
4ca0dba9e224473d664c25e411f5a3bd- SHA1
c22dc62e10378191840285814838fe9ed1af55d7- SHA256
71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5- Imphash
0f3ddbe229201f6fa9a3dbbaf842a556- Authentihash MD5
7712f7c4cc208b66d3cbc726b490b167- Authentihash SHA1
c613b7797a6c1f31271f8f5dced8515d8e4f5732- Authentihash SHA256
489c02d8102fc401010793d7388b59dc944a2e77cf4179424015cd863701b19b- Machine
- AMD64
- Version
- 5.0.2195.1711
- Publisher
- Windows (R) 2003 DDK 3790 provider
rtport.sysSample 4 · HVCI FALSE
- MD5
49832b4f726cdff825257bee33ad8451- SHA1
1bd4ae9a406bf010e34cdd38e823f732972b18e3- SHA256
8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65- Imphash
0f3ddbe229201f6fa9a3dbbaf842a556- Authentihash MD5
7712f7c4cc208b66d3cbc726b490b167- Authentihash SHA1
c613b7797a6c1f31271f8f5dced8515d8e4f5732- Authentihash SHA256
489c02d8102fc401010793d7388b59dc944a2e77cf4179424015cd863701b19b- Machine
- AMD64
- Version
- 5.0.2195.1711
- Publisher
- Windows (R) 2003 DDK 3790 provider
rtport.sysSample 5 · HVCI TRUE
- MD5
ab81264493c218a0e875a0d50104ac9f- SHA1
f70989f8b17971f13d45ee537e4ce98e93acbbaf- SHA256
a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e- Imphash
8d2a933d039e8b8134ef41236d5ea843- Authentihash MD5
54e480b9f11b70e944e0e5b1130116c8- Authentihash SHA1
24d9958ec0fedb77e9b5d5deba3117abaca9803f- Authentihash SHA256
fe275be26ecca4c69f1c8ec35145fcae8cd83a5cb20f7ca71ff998d91091bb7e- Machine
- I386
- Version
- 5.00.2195.1
- Publisher
- Windows (R) 2000 DDK provider
rtport.sysSample 6 · HVCI TRUE
- MD5
bc71da7c055e3172226090ba5d8e2248- SHA1
bfff0073c936b9a7e2ad6848deb6f9bf03205488- SHA256
c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b- Imphash
8d2a933d039e8b8134ef41236d5ea843- Authentihash MD5
914defd13cc2e1b6c4d42a7f806c8b45- Authentihash SHA1
c2308ff02a8a05d7b20e59d7734b90fe950d15bc- Authentihash SHA256
74264ce2e0ed67730b0f3c719aee37664d4688f872875322a64022cd68e060bb- Machine
- I386
- Version
- 5.00.2195.1
- Publisher
- Windows (R) 2000 DDK provider
rtport.sysSample 7 · HVCI TRUE
- MD5
843e39865b29bb3df825bd273f195a98- SHA1
3fd5cd30085450a509eaa6367af26f6c4b9741b6- SHA256
e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16- Imphash
8d2a933d039e8b8134ef41236d5ea843- Authentihash MD5
21b25c420a7e1569c8b26d93edf9548f- Authentihash SHA1
5599900b51571f6557c862f5d82b8f6706a21a9d- Authentihash SHA256
353a36d445e4ff60396702ad7b22b5f30bdce52aa05126e2701714a3f11a11c7- Machine
- I386
- Version
- 5.00.2195.1
- Publisher
- Windows (R) 2000 DDK provider
rtport.sysSample 8 · HVCI TRUE
- MD5
3c9f9c1b802f66cf03cbe82dec2bd454- SHA1
8b037d7a7cb612eabd8e20a9ce93afd92a6db2c2- SHA256
ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1- Imphash
8b41eacbfbe5f5348579e27d30767e74- Authentihash MD5
418f88ade9d08467bc9401fc7b76cc2a- Authentihash SHA1
93c1b76f3fb828aaf98d37e6c138fc948f75f748- Authentihash SHA256
ebe114a72d27b5abf47e17137dbb85f52ca987c8bb80ea709eb3293c9637f73c- Machine
- I386
- Version
- 1.0.01.0000
- Publisher
- REALTEK Semiconductor Corp.
Recorded command
sc.exe create rtportsys binPath= C:\windows\temp\rtportsys.sys type=kernel && sc.exe start rtportsysElevate privileges · Privileges: kernel · OS: Windows 10