← Back to driver explorer
Driver intelligenceVulnerableVerified
SBIOSIO64.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 4
0 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
SBIOSIO64.sysSample 1 · HVCI FALSE
- MD5
942c6a8332d5dd06d8f4b2a9cb386ff4- SHA1
06ec56736c2fc070066079bb628c17b089b58f6c- SHA256
1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d- Imphash
a5fd3b0143c8db98017ec1b2b2528360- Authentihash MD5
d125184c23727d2e5f3c3f05e7d7e5db- Authentihash SHA1
40eb3d916518582bbbd358d7ea84bb852664faac- Authentihash SHA256
2ff73944c43821b3d13abc37245c2c8d4eadc876dead02da45ea82fdf1525973- Machine
- I386
- Version
- 1.0.0000.0
- Publisher
- Windows (R) Win 7 DDK provider
SBIOSIO64.sysSample 2 · HVCI FALSE
- MD5
d98d2f80b94f70780b46d1f079a38d93- SHA1
0e47bd9b67500a67ce18c24328d6d0db8ae2c493- SHA256
39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0- Imphash
16b23f4c6ea47d01340a2cce4bf613f7- Authentihash MD5
097a1574923b78c25f2f89e4e8dd0889- Authentihash SHA1
d0ad756e0f7403307d3df85325ecb9c348b312af- Authentihash SHA256
e53dabeff15be08a23fb7eccfd82fd1dbdc3de857b28209dac3b4b2bdc3cb13a- Machine
- AMD64
- Version
- 1.0.0000.0
- Publisher
- Windows (R) Win 7 DDK provider
SBIOSIO64.sysSample 3 · HVCI FALSE
- MD5
b7946feaeae34d51f045c4f986fa62ce- SHA1
fc69138b9365fa60e21243369940c8dcfcca5db1- SHA256
442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243- Imphash
e586fd1c5af87b43696b9d29b09bf1b1- Authentihash MD5
eaf5ab9ab74419bee881d0714f922b5b- Authentihash SHA1
e6584d2254a8d0a31c7988b0eecc2cee6990ce3f- Authentihash SHA256
a0dbcf82dc346a49a816b3a6283392c9f2531661e460072ba063be898e5cbda0- Machine
- AMD64
- Version
- 1.1.0000.0
- Publisher
- Windows (R) Win 7 DDK provider
SBIOSIO64.sysSample 4 · HVCI FALSE
- MD5
3c9c537167923723429c86ab38743e7d- SHA1
ee877b496777763e853dd81fefd0924509bc5be0- SHA256
b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c- Imphash
8f4588156ea7d9af8e4c162ce4c3ff23- Authentihash MD5
d69685c4fb9d98f92f4c4a9bda2d421d- Authentihash SHA1
7f18a1c6513e3f5ac06e0a915106cf8a11c9fccd- Authentihash SHA256
6208a115fc72bc9014c7debb188c473c41f64e7ffeb3efbd31af6c48c0726702- Machine
- I386
- Version
- 1.1.0000.0
- Publisher
- Windows (R) Win 7 DDK provider
Recorded command
sc.exe create SBIOSIO64sys binPath= C:\windows\temp\SBIOSIO64sys.sys type=kernel && sc.exe start SBIOSIO64sysElevate privileges · Privileges: kernel · OS: Windows 10