← Back to driver explorer
Driver intelligenceVulnerableVerified
SysInfoDetectorX64.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
SysInfoDetectorX64.sysSample 1 · HVCI FALSE
- MD5
33fc573c0e8bedfe3614e17219273429- SHA1
258f1cdc79bd20c2e6630a0865abfe60473b98d5- SHA256
45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271- Imphash
d16f507665603095c26147a7adcb93b8- Authentihash MD5
7aad8dc791435b53a1d98b68181603f6- Authentihash SHA1
a5f7dbc6e9038b2bc9dc44eb8a9ffa437c3cdb1d- Authentihash SHA256
096e1641d26aa971dabc7de17c0259d3aa922091e38928ba7847e4ead64b7f41- Machine
- AMD64
- Version
- 2.0.0.3
- Publisher
- Database Harbor Software
Recorded command
sc.exe create SysInfoDetectorX64sys binPath= C:\windows\temp\SysInfoDetectorX64sys.sys type=kernel && sc.exe start SysInfoDetectorX64sysElevate privileges · Privileges: kernel · OS: Windows 10