← Back to driver explorer
Driver intelligenceVulnerableVerified
AODDriver.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 13
6 recorded TRUE · 7 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
AODDriver.sysSample 1 · HVCI FALSE
- MD5
2faa725dd9bb22b2100e3010f8a72182- SHA1
5ce273aa80ed3b0394e593a999059096682736ae- SHA256
070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103- Imphash
48028b3b694466c1c0eb1d91ef5c02cb- Authentihash MD5
28eeecde23e284924186b1c40f263fb1- Authentihash SHA1
84a576d26cfb5dac55308ab00c3b6a5558f162ca- Authentihash SHA256
42f468244050bafdcfc061c0eb468fd78267f93404b8703353d68fdca8b4355e- Machine
- I386
- Version
- 4.2.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
AODDriver.sysSample 2 · HVCI TRUE
- MD5
03c9d5f24fd65ad57de2d8a2c7960a70- SHA1
e5bfb18f63fcfb7dc09b0292602112ea7837ef7a- SHA256
33d7046a5d41f4010ad5df632577154ed223dac2ab0ca2da57dbf1724db45a57- Imphash
30c0ed518c03fa46fa0bfe76f2db0e42- Authentihash MD5
f431c34b502d259aa61092efb68bea83- Authentihash SHA1
d4cb7f2539b32d0445dc1fb21c022e244fe8a7e7- Authentihash SHA256
cb3dd0482092eb019dc11797dcf09f69fb3f06330e1fba0047678b226b57c2cd- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 3 · HVCI FALSE
- MD5
43ed1d08c19626688db34f63e55114fb- SHA1
0f2fdfb249c260c892334e62ab77ac88fcb8b5e4- SHA256
3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d- Imphash
7716b766e630388f64de1961719be3d4- Authentihash MD5
f3a6f467fb2f1a7f65285aa0e4d24990- Authentihash SHA1
fc8f64827ea4a6a787ea304f3dfc599ec1cd935a- Authentihash SHA256
2381e9fc518488f51e3ec49d5ca4e59d10727d20678067ca147e50b0c4294f9a- Machine
- AMD64
- Version
- 3.1.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
AODDriver.sysSample 4 · HVCI FALSE
- MD5
1a6e12c2d11e208bdf72a8962120fae7- SHA1
17d28a90ef4d3dbb083371f99943ff938f3b39f6- SHA256
478bcb750017cb6541f3dd0d08a47370f3c92eec998bc3825b5d8e08ee831b70- Imphash
cb8397a3262c80b558aff93ab75b6a7b- Authentihash MD5
b5d2eb2549f75a4a1ced7a0df90fb96e- Authentihash SHA1
9a329362e340fc8363e67fb5f23a8391cb83bf00- Authentihash SHA256
ffd548833a96c2c5f8410b22fc110d10b36a47eb0b16b3d2e7edb82c3cabf97b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 5 · HVCI TRUE
- MD5
21ca6a013a75fcf6f930d4b08803973a- SHA1
b3b523504af5228c49060ec8dea9f8adce05e117- SHA256
49ae47b6b4d5e1b791b89e0395659d42a29a79c3e6ec52cbfcb9f9cef857a9dd- Imphash
7f8c74638fcf297f8216aa5b184f61d6- Authentihash MD5
da65f47b65a05396e9d3e53872af5b50- Authentihash SHA1
4a726544ef24840f38af646c3f1609e51f42c7d8- Authentihash SHA256
d033f5c0a764aa7ecff779cf7fe13140d7d8eb1645dd212f408ed2fa119e3b47- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 6 · HVCI FALSE
- MD5
f160ecce1500a5a5877c123584e86b17- SHA1
dda8c7e852fe07d67c110dab163354a2a85f44a5- SHA256
4ace6dded819e87f3686af2006cb415ed75554881a28c54de606975c41975112- Imphash
cb8397a3262c80b558aff93ab75b6a7b- Authentihash MD5
b5d2eb2549f75a4a1ced7a0df90fb96e- Authentihash SHA1
9a329362e340fc8363e67fb5f23a8391cb83bf00- Authentihash SHA256
ffd548833a96c2c5f8410b22fc110d10b36a47eb0b16b3d2e7edb82c3cabf97b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 7 · HVCI FALSE
- MD5
b934322c68c30dceca96c0274a51f7b0- SHA1
18938e0d924ee7c0febdbf2676a099e828182c1c- SHA256
5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9- Imphash
7f53340c91c108efedb5b8678c5207b3- Authentihash MD5
bc5b3e62168d06b6581755afd6fd4f5d- Authentihash SHA1
01c9d8a69065cbc8aba2d00ed69628e3b847b167- Authentihash SHA256
129bfa559bde499f748cffc218f2b7ec4b22ee3114ceae8e386fbbe4e58e4523- Machine
- AMD64
- Version
- 3.1.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
AODDriver.sysSample 8 · HVCI FALSE
- MD5
fe3fb6719e86481a3514ab9e00a55bcf- SHA1
e8311ba74bc6b35b1171b81056d0148913b1d61c- SHA256
5daa8fa3b5db2e6225a2effea41af95fe7ffc579550c4081c8028ed33bc023b8- Imphash
7716b766e630388f64de1961719be3d4- Authentihash MD5
59bd50b9577bdfca5452e158725b96a1- Authentihash SHA1
3099e0d37fd0ee97738cf271bae3793a91b88382- Authentihash SHA256
5640179b9cffc3517d322ac2c0bc1258b563f65ebb1b67eb22ecf7f3a0500c7d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 9 · HVCI TRUE
- MD5
0ad87bba19f0b71ccb2d32239abd49ec- SHA1
e0ee5ea6693c26f21b143ef9b133f53efe443b1e- SHA256
7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca- Imphash
51ecd9b363fde1f003f4b4f20c874b1b- Authentihash MD5
7f337e0d90850309bb5bc8a847ee6336- Authentihash SHA1
fcbbd7b4d138e4f2c2a23c32437e96e87af2019a- Authentihash SHA256
84683c840af3440b8b40d34088ec852e092f882ca558409d8338f1f5f46d2741- Machine
- I386
- Version
- 3.1.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
AODDriver.sysSample 10 · HVCI TRUE
- MD5
5bd30b502168013c9ea03a5c2f1c9776- SHA1
7b4c922415e13deaf54bb2771f2ae30814ee1d14- SHA256
81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05- Imphash
2430f988dcdc3828f6079e1e2cc71dc8- Authentihash MD5
08641141599e00b60cf7f5b4f16c7410- Authentihash SHA1
c2e6ad05c0bcf694f024a3fc561dc987e4a28396- Authentihash SHA256
6fcb7131bc940fc01dc5444a1ae18bf299e92c3155a783629007cf2a61cda9db- Machine
- I386
- Version
- 3.2.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
AODDriver.sysSample 11 · HVCI TRUE
- MD5
c5b8e612360277ac70aa328432a99fd6- SHA1
f5bafebfbfb67a022452870289ac7849e9ee1f61- SHA256
8a982eed9cbc724d50a9ddf4f74ecbcd67b4fdcd9c2bb1795bc88c2d9caf7506- Imphash
2d7766896629499b1484227afaf43dd7- Authentihash MD5
84420ea7b0d040aaaff4d2a2743a5eaf- Authentihash SHA1
23ac84bd285d1e6d2598b4eea65aac22015a76ef- Authentihash SHA256
79247cd973878500461753431f1528ed35e5f85a8978bf68ac211335ffcae27a- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 12 · HVCI TRUE
- MD5
cd1c8a66e885b7a8b464094395566a46- SHA1
1ab702c495cb7832d4cc1ff896277fa56ed8f30d- SHA256
ef438a754fd940d145cc5d658ddac666a06871d71652b258946c21efe4b7e517- Imphash
c1579e4266fbdc47a5abc493a2d9d597- Authentihash MD5
f398a5cf97cb3693c094d0c0560f4f5b- Authentihash SHA1
81282dd51b710f930a5f8d4da65521be1d06fc63- Authentihash SHA256
b0e2a4bf10a9428888e043fa40f7af74a963ed663c6bf4e2f136e39c41f606db- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
AODDriver.sysSample 13 · HVCI FALSE
- MD5
5f44a01ccc530b34051b9d0ccb5bb842- SHA1
c520a368c472869c3dc356a7bcfa88046352e4d9- SHA256
f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2- Imphash
f119bff607049d431d0968fbaf6532f3- Authentihash MD5
3958bf0abbaf2cb70708bc790b89840a- Authentihash SHA1
7686074bc96fc23d94c2347c11fae073d86ac401- Authentihash SHA256
4ce5523dea824b2f2d4d442a9016d0f1b7cc52dce58a1740f4c43fd28e1c6dcb- Machine
- AMD64
- Version
- 4.2.0 built by: WinDDK
- Publisher
- Advanced Micro Devices
Recorded command
sc.exe create AODDriversys binPath= C:\windows\temp\AODDriversys.sys type=kernel && sc.exe start AODDriversysElevate privileges · Privileges: kernel · OS: Windows 10