Driver intelligenceVulnerableVerified

directio64.sys

PassMark DirectIo64.sys builds through b1008 expose permissively accessible IOCTLs for physical memory, MSRs, PCI configuration space, x86 I/O ports, and kernel or physical-memory dumps. These primitives can support local SYSTEM elevation, kernel tampering, credential exposure, or denial of service. PassMark hardened the driver in b1012.

UUID / a254e684-f6eb-40c4-a50a-7b76feb6cc02ADDED / 2023-07-22AUTHOR / Michael Haag

Known samples 2

0 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

directio64.sysSample 1 · HVCI FALSE

MD5: afbb28a756e233d32e224a664763f79c
SHA1: e44297a2b750ec1958bef265e2f1ae6fa4323b28
SHA256: d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5
Imphash: cef6a450f196b28e634aa3c0655d8eda
Authentihash MD5: 0c357509adc3c4e42390c50a6a79575d
Authentihash SHA1: fca1ee04be5d7752a1ad717a6aac9c143c5c8bcd
Authentihash SHA256: e219276a4068b1eea5ce08f83a322845dce4eca89e05c71a0c2417065ce48813
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample ↗View on VirusTotal ↗

DirectIo64.sysSample 2 · HVCI unknown

MD5: db6d09b6ea72411f715f3effe1b42ca7
SHA1: 8e71859907ea3c2198a0b32a9b6c7b69feb8879a
SHA256: b147a26dad59d9109710798b033ec3504a799f02e4356a358d6e32fdf7841b4a
Imphash: e8957f92fb9f2c1b4e23f2ae68c84a43
Authentihash MD5: 3d44547dd930c1f0451574129dc05f39
Authentihash SHA1: b5674bde7cb1c49a23d6c937b80a1b1478e24bc2
Authentihash SHA256: ed4e21364c3b077d5f5b53ff53db009ca735ad2b66b21559d25ef2c6689dfd1b
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample ↗View on VirusTotal ↗

Research & references

Acknowledgement: Emil Sorbroden floppywiggler