← Back to driver explorer
Driver intelligenceVulnerableVerified
BioNTdrv.sys
Paragon Hard Disk Manager BioNTdrv.sys versions 10.1.x and older, 1.0.0.0, 1.1.0.0, 1.3.0.0, 1.4.0.0, and 1.5.1.0 contain five vulnerabilities that expose arbitrary kernel-memory mapping, write, and move operations, insecure kernel resource access, and a null-pointer dereference. Local attackers can use the affected driver to elevate to SYSTEM or cause a denial of service. CVE-2025-0289 has been observed in ransomware BYOVD attacks. Version 2.0.0 fixes the flaws.
Known samples 6
0 recorded TRUE · 0 recorded FALSE · 6 unknown for loading despite HVCI. Results apply to individual samples.
BioNTdrv.sysSample 1 · HVCI unknown
- MD5
414904e1562e3fd9ea5d9539989b3f03- SHA1
3e2b19b7111393987f0f8ba99693baef3ced5d56- SHA256
f83560719a0054cb9911811372d0fcb2d8b3704d30c5503cd0aeeccda3dc6b4b- Imphash
6dfbd0e495cff008f6a4255e4df45629- Authentihash MD5
ed52d9d3f5f21a926a5223d5e2e6abe2- Authentihash SHA1
980f3b4a77d2fc3183d3772cd7f68edc45030ab7- Authentihash SHA256
7cb0ab6ed54b51910f2970a2a43513fdd7caa7bb0676d31578e75ac5482722ad- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
BioNTdrv.sysSample 2 · HVCI unknown
- MD5
42e7463e46255bf19b9b540d65ed304c- SHA1
21da44b8390a07dfa88bc3cc3d100b6ee1ce7c6c- SHA256
6415b01fbe1e2694547c472f3fad6e17ffb33efdfb44a89cbb623cbd4f731f2a- Imphash
6dfbd0e495cff008f6a4255e4df45629- Authentihash MD5
d03a562dd5f28d6febb14fcfb7649b83- Authentihash SHA1
408490a6ab7e91c0e7b84bc933baccae2b65d02f- Authentihash SHA256
0fd3e7810b7af01db22a46964389f4483ef8d58b3468f32fd1b034bf80d63c2e- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
BioNTdrv.sysSample 3 · HVCI unknown
- MD5
bee39ff7c8be071f14d1285596e6c34b- SHA1
5cc6394fbfc6ea3638df534e0e069de536899171- SHA256
69a9c8f3134130617f3bbe19a7221752d98f029763cd2d9100fec4680333ed16- Imphash
1014dd148858e163ab9a4d27d0e3594a- Authentihash MD5
8a073d569af673fd00a46eea75cb5a57- Authentihash SHA1
7816451a304e92aa6f975e62bcee0746892ac8ca- Authentihash SHA256
c5062c8d91eda5579ee627746b367e37f60eb717f7148f6885ad6bcf315203d6- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
BioNTdrv.sysSample 4 · HVCI unknown
- MD5
d2fdad79aa8fc5c66687dc8516cab756- SHA1
6ac13b7105b6bab8bfed4fe6f3d218c114aa7474- SHA256
e78f14d0adf4c5599b09d3995f84d265dbea20fc25112a9c3227b7a35910ca90- Imphash
6dfbd0e495cff008f6a4255e4df45629- Authentihash MD5
edf14b6e661abc745b49e10e3da97bd4- Authentihash SHA1
aa141feaf476984e17aa906e9d80ea659e504d53- Authentihash SHA256
0da70668222c4472540ff820f70b70fa3a0243595880d9401adf60572c24b464- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
BioNTdrv.sysSample 5 · HVCI unknown
- MD5
ef32d203a12462403c205b39eb4eef5b- SHA1
b31a85406ac9a6a69bfbee74d6dc67d9d7bddee6- SHA256
fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0- Imphash
1014dd148858e163ab9a4d27d0e3594a- Authentihash MD5
8d1f5412cc6e58af2bdbff2e179f298d- Authentihash SHA1
5d01cd9701213f7fd4073507cdbe18f4b742baf7- Authentihash SHA256
efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
BioNTdrv.sysSample 6 · HVCI unknown
- MD5
525ef6014f0ef20e44fe47c1d9980b69- SHA1
cab45e9d03efa8a09595b99b275caadb8f250811- SHA256
174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe- Imphash
f4f462bcde0472cb6202214475f889b1- Authentihash MD5
778ca6c522c672bdd509cd37339916c8- Authentihash SHA1
66f199e8edc9580a33c81d056b34b590481a7f01- Authentihash SHA256
015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Paragon Software GmbH
Recorded command
sc.exe create BioNTdrv.sys binPath=C:\windows\temp\BioNTdrv.sys type=kernel && sc.exe start BioNTdrv.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://kb.cert.org/vuls/id/726882
- https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/
- https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
- https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys