← Back to driver explorer
Driver intelligenceVulnerableVerified
CP2X72C.SYS
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 5
0 recorded TRUE · 5 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
CP2X72C.SYSSample 1 · HVCI FALSE
- MD5
c8d3784a3ab7a04ad34ea0aba32289ca- SHA1
8b63eb0f5dbb844ee5f6682f0badef872ae569bf- SHA256
05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686- Imphash
7a286ef4179598007a8afe9e5af95a48- Authentihash MD5
cd3000188fccd86bdd61590fbdf952e1- Authentihash SHA1
eb4ea030ab0bd3b78ef513c39bd6a9c84a723962- Authentihash SHA256
145b3490f5d3f45dc014d8c14112e9973796024ef1e896a10998f08bba45d8e5- Machine
- I386
- Version
- 3.30.33.0
- Publisher
- Interface Corporation
CP2X72C.SYSSample 2 · HVCI FALSE
- MD5
ad612a7eb913b5f7d25703cd44953c35- SHA1
2ba0db7465cf4ffb272f803a9d77292b79c1e6df- SHA256
11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359- Imphash
787e32b3fd816479fb93f9af0b6d0da3- Authentihash MD5
3ea1e0ce9e19d6f8d5eeb4bca0b39a32- Authentihash SHA1
aef1fb88d1ba3e38694ca2fd1e845ec4b3668f4b- Authentihash SHA256
b44dfe8ea675910799fefab7626993926c04bad32091ece3dbdad5add31a6f15- Machine
- I386
- Version
- 1.61-20
- Publisher
- Interface Corporation
CP2X72C.SYSSample 3 · HVCI FALSE
- MD5
2601cf769ad6ffee727997679693f774- SHA1
0536c9f15094ca8ddeef6dec75d93dc35366d8a9- SHA256
4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f- Imphash
e08b2d7c450761f01ec9ed4ef0ca56a4- Authentihash MD5
eab512f1f1e844469d104076f8243695- Authentihash SHA1
4288602c828247d96839e8f89fd8aa063a5ca371- Authentihash SHA256
b177164100a31fd01e7f0a24cb0a32015736d3c7c65744c21914a2d4459ef83d- Machine
- AMD64
- Version
- 3.30.33.0
- Publisher
- Interface Corporation
CP2X72C.SYSSample 4 · HVCI FALSE
- MD5
de2aac9468158c73880e31509924d7e0- SHA1
d9b05c5ffc5eddf65186ba802bb1ece0249cab05- SHA256
63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e- Imphash
7a286ef4179598007a8afe9e5af95a48- Authentihash MD5
c21ee0f8ba66b8b72e43158fd740f4dd- Authentihash SHA1
7ec84ab4170b0b911d5a21d717d06aeb7a8c8ace- Authentihash SHA256
3c03433ea3376f6f099ad77a4ce59187817d1bc0c3c0f55fd931320d909dd920- Machine
- I386
- Version
- 3.02.30.0
- Publisher
- Interface Corporation
CP2X72C.SYSSample 5 · HVCI FALSE
- MD5
e98f4cc2cbf9ec23fd84da30c0625884- SHA1
67e87ca093da64a23cf0fc0be2b35e03d1bf1543- SHA256
9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91- Imphash
e08b2d7c450761f01ec9ed4ef0ca56a4- Authentihash MD5
3189fc90f7a5a27e512fb733de818110- Authentihash SHA1
2170ba5d21bf949702480a0419d08bf00321afe5- Authentihash SHA256
054f04dc0ba1b20701c6f44169ea0fdd27b01a8450a44cc273b0eb0c91cbdb68- Machine
- AMD64
- Version
- 3.02.30.0
- Publisher
- Interface Corporation
Recorded command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSElevate privileges · Privileges: kernel · OS: Windows 10