← Back to driver explorer
Driver intelligenceVulnerableVerified
IoAccess.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 2
1 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
IoAccess.sysSample 1 · HVCI TRUE
- MD5
c15eb30e806ad5e771b23423fd2040b0- SHA1
e0d12e44db3f57ee7ea723683a6fd346dacf2e3e- SHA256
b78eb7f12ba718183313cf336655996756411b7dcc8648157aaa4c891ca9dbee- Imphash
c83f076c00d2b0a6ba9dc82f56a97631- Authentihash MD5
c36bebe2a76152bab204272b0bb789df- Authentihash SHA1
04d4fcdb3deb92b5424cda42b6870d4be6f47d33- Authentihash SHA256
5868cb3bf5d5a9237e29210218d3d93683c0e4894bc48685ac7d84a1e25e0462- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
IoAccess.sysSample 2 · HVCI FALSE
- MD5
9c3c250646e11052b1e38500ee0e467b- SHA1
03257294ee74f69881002c4bf764b9cb83b759d6- SHA256
b9e0c2a569ab02742fa3a37846310a1d4e46ba2bfd4f80e16f00865fc62690cb- Imphash
2b9471e7bb8c05dc55d0a2ff0591ea98- Authentihash MD5
e84c6faab5ee23b8581c1ef7ac659f30- Authentihash SHA1
f423ba27068de365c22e92d36bf27d5b59dc1f4c- Authentihash SHA256
f82cde6dc693a4ac8b485ac9225f2641141213f8333b0be8d7134d0139f17c26- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create IoAccesssys binPath= C:\windows\temp\IoAccesssys.sys type=kernel && sc.exe start IoAccesssysElevate privileges · Privileges: kernel · OS: Windows 10