Driver intelligenceVulnerableVerified

echo_driver.sys

Bad access controls in Inspect Element Ltd.'s echo_driver.sys allows attacker to gain arbitrary memory read and write, which allows for easy Privilege Escalation via Token Theft.

UUID / afb8bb46-1d13-407d-9866-1daa7c82ca63ADDED / 2023-07-14AUTHOR / Protocol & Zach

Known samples 5

0 recorded TRUE · 5 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

echo_driver.sysSample 1 · HVCI FALSE

MD5: 187ddca26d119573223cf0a32ba55a61
SHA1: a93197c8c1897a95c4fb0367d7451019ae9f3054
SHA256: ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9
Imphash: a94892b77a6474429b9f692d9952a9d5
Authentihash MD5: cad120d8ba6473b07a3b76a41921d720
Authentihash SHA1: 678620a9cc9e7ffe179bc5cda0a2dd0597e231ee
Authentihash SHA256: 92f9d73cec5ab3352c4b3cbf4574d13b2e506cba24cc74580e19e941063eaf7d
Machine: AMD64
Version: Not recorded
Publisher: Microsoft Windows Hardware Compatibility Publisher

Download vulnerable sample View on VirusTotal

echodriverSample 2 · HVCI FALSE

MD5: 69fd73a83df164d7fe5d89e006e945dc
SHA1: 2fcfb50b5c91dd3e3b48d91a60acc26138f406b6
SHA256: a41e9bb037cf1dc2237659b1158f0ed4e49b752b2f9dae4cc310933a9d1f1e47
Imphash: 8b9e0d788c2eaf2c7f14613be96a14ef
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

View on VirusTotal

echodriver.sysSample 3 · HVCI FALSE

MD5: 410b44dc8ec9e756e2abdbb406aa42ad
SHA1: 04fd5eb356f63e2afc218a32aa7c27c9e9a5c42a
SHA256: ada2b855757c9062231f5ed4e80365b8d8094e9adbce8f26d1ff5ea0b7a70c77
Imphash: a2180e353b7db3ab59bab0bbbd09962b
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

View on VirusTotal

echo.sysSample 4 · HVCI FALSE

MD5: 1585d3eda733dfe42202bb98f95f7f5d
SHA1: 8a0d8b31fc2cdc44cb5a8547b7a63600307dd2d4
SHA256: 1aed62a63b4802e599bbd33162319129501d603cceeb5e1eb22fd4733b3018a3
Imphash: d5b8227536ae03b96e542a52b80aab47
Authentihash MD5: 327bac48ef5c3162aaf555878ef89338
Authentihash SHA1: 3653d167ffa47da551267c179a4b4f23430271b7
Authentihash SHA256: 2e100aa891445f18f4805dced7c4055aa5bee6c65995daa42a438349ccad6c3c
Machine: I386
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

rentdrv2.sysSample 5 · HVCI FALSE

MD5: 5fea22f442e7fd34a54008e363446d13
SHA1: 67d17ca90880b448d5c3b40f69cec04d3649f170
SHA256: 9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5
Imphash: 1fb8e85267a70537d661f9df2fc215ac
Authentihash MD5: b0c6112ed0f7a1544320e96c4e28dfaf
Authentihash SHA1: cebe563de888ee2055ba03051010a40705e778c8
Authentihash SHA256: b3c9af8c4be8f62d25b955f92d2a4e9ebd34f7fa787580454ef54241102e7b30
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create echo_driver.sys binPath=C:\windows\temp\echo_driver.sys type=kernel && sc.exe start echo_driver.sys

Elevate privileges, arbitrary memory read/write · Privileges: kernel · OS: Windows 10/11

Research & references

Acknowledgement: protocol @WindowsKernel