← Back to driver explorer
Driver intelligenceVulnerableVerified
WiRwaDrv.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
WiRwaDrv.sysSample 1 · HVCI FALSE
- MD5
7be3a7a743f2013c3e90355219626c2c- SHA1
a951953e3c1bb08653ed7b0daec38be7b0169c27- SHA256
d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e- Imphash
21f58b1f2de6ad0e9c019da7a4e7317b- Authentihash MD5
b27ddf036b235b1a2a0f9c3869cf12e5- Authentihash SHA1
d6540f9784c51a4bf08b59e7398de5bacb4e9011- Authentihash SHA256
c7e5bd0090962b4f31e17ab3d1f97bd9870d23238b591a70e27a0c91db138f95- Machine
- AMD64
- Version
- 1.0.0.1016
- Publisher
- Wistron Corporation
Recorded command
sc.exe create WiRwaDrvsys binPath= C:\windows\temp\WiRwaDrvsys.sys type=kernel && sc.exe start WiRwaDrvsysElevate privileges · Privileges: kernel · OS: Windows 10