Driver intelligenceVulnerableVerified

CtiIo64.sys

The driver is part of Dragon Center (or MSI Center?) from MSI. It creates \Device\CtiIo ACLless DO and provides access to memory and IO. The driver is signed with WHQL cert.

UUID / de365e80-45cb-48fb-af6e-0a96a5ad7777ADDED / 2023-05-22AUTHOR / zwclose

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

CtiIo64.sysSample 1 · HVCI FALSE

MD5: 3f8cdaf7413000d34d6a1a1d5341a11b
SHA1: c1c869deee6293eee3d0d84b6706d90fab8f8558
SHA256: 2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109
Imphash: 8a424cd36ae3eab0d11332ce3b982a02
Authentihash MD5: 6bbd44ee42e3bbc6b4acc12fe11d765a
Authentihash SHA1: a19ec41abb65a26116bce1413470271d89d18995
Authentihash SHA256: 2b4af74d74a4380130a1c46d2f1ffe112d87d9d7646540bbbd201c5bd176082b
Machine: AMD64
Version: 1.0 x64 built by: WinDDK
Publisher: Creative Technology Innovation Co., LTd.

View on VirusTotal

Recorded command

sc.exe create CtiIo64.sys binPath=C:\windows\temp\CtiIo64.sys type=kernel && sc.exe start CtiIo64.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

https://github.com/magicsword-io/LOLDrivers/pull/81

Acknowledgement: zwclose @zwclose