← Back to driver explorer
Driver intelligenceVulnerableVerified
GtcKmdfBs.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 5
5 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
GtcKmdfBs.sysSample 1 · HVCI TRUE
- MD5
e4ea7ebfa142d20a92fbe468a77eafa6- SHA1
31529d0e73f7fbfbe8c28367466c404c0e3e1d5a- SHA256
0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664- Imphash
b1ed268dfdf4f39960971eb5822a4755- Authentihash MD5
dfc36c92d6e0de7f4f181f421812d103- Authentihash SHA1
9792ae85f09261a18cfc30a68d2dae36cebd3163- Authentihash SHA256
5d8a10b966e30ee6a696ecc6809936411be7ff672593998693c6b1a58baf0e42- Machine
- AMD64
- Version
- 21, 2, 0, 4
- Publisher
- Getac Technology Corporation
GtcKmdfBs.sysSample 2 · HVCI TRUE
- MD5
449bb1c656fa30de7702f17e35b11cd3- SHA1
273634ac170d1a6abd32e0db597376a6f62eb59e- SHA256
4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51- Imphash
fc789f89340a45f1ab6c49e61b1f6b40- Authentihash MD5
297e5b42f20370c97d9d0ae19a1335ff- Authentihash SHA1
6d3a6ace2ba6ceb28fbec4995fc3f206054609fc- Authentihash SHA256
cf63f518c9e45fe87d336c87938eb587049602707f1ed16d605f8521f88e4a96- Machine
- AMD64
- Version
- 21, 2, 0, 3
- Publisher
- Getac Technology Corporation
GtcKmdfBs.sysSample 3 · HVCI TRUE
- MD5
4ec08e0bcdf3e880e7f5a7d78a73440c- SHA1
a22c111045b4358f8279190e50851c443534fc24- SHA256
e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822- Imphash
b4a71a1265f5f82cf383af17e229acb5- Authentihash MD5
2981c28ff4148a7b1ecb4ed28e389319- Authentihash SHA1
571a9735893053c2540bf40d353094b5576464af- Authentihash SHA256
1eff553cab0e6db50aa18e1ea10fbc9349b7529c938df4bed580f037cddd1309- Machine
- AMD64
- Version
- 21, 2, 0, 1
- Publisher
- Getac Technology Corporation
GtcKmdfBs.sysSample 4 · HVCI TRUE
- MD5
cc35379f0421b907004a9099611ee2cd- SHA1
2e9466d5a814c20403be7c7a5811039ca833bd5d- SHA256
e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5- Imphash
fc9c0ba924e7f104eda5254aaeacc5e8- Authentihash MD5
f0459065e545f61f3e87d36e23dbf9c5- Authentihash SHA1
578a154d0420b3575d26060061428b2feb793356- Authentihash SHA256
37b0aaf4e3cdc9d4c475a3a08ad2ba1e28e177d7359546c9b0bba14ae73dfed0- Machine
- I386
- Version
- 20, 2, 0, 3
- Publisher
- Getac Technology Corporation
GtcKmdfBs.sysSample 5 · HVCI TRUE
- MD5
9993a2a45c745bb0139bf3e8decd626c- SHA1
68b97bfaf61294743ba15ef36357cdb8e963b56e- SHA256
edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5- Imphash
fc789f89340a45f1ab6c49e61b1f6b40- Authentihash MD5
297e5b42f20370c97d9d0ae19a1335ff- Authentihash SHA1
6d3a6ace2ba6ceb28fbec4995fc3f206054609fc- Authentihash SHA256
cf63f518c9e45fe87d336c87938eb587049602707f1ed16d605f8521f88e4a96- Machine
- AMD64
- Version
- 21, 2, 0, 3
- Publisher
- Getac Technology Corporation
Recorded command
sc.exe create GtcKmdfBssys binPath= C:\windows\temp\GtcKmdfBssys.sys type=kernel && sc.exe start GtcKmdfBssysElevate privileges · Privileges: kernel · OS: Windows 10