← Back to driver explorer
Driver intelligenceVulnerableVerified
GEDevDrv.SYS
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 4
0 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
GEDevDrv.SYSSample 1 · HVCI FALSE
- MD5
4514a0e8bcab7de4cff55999cdf00cd1- SHA1
faa61346430aedc952d820f7b16b973c9bf133c3- SHA256
51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb- Imphash
c7912c850407aa93c979d95c4f593507- Authentihash MD5
48b814c2df4c1a15512c8a32b45766ba- Authentihash SHA1
ed3f9e742b37a81db447d9d398f3ea26235e05aa- Authentihash SHA256
33494ed37d4be23b7de493d5f2c9c31a83a7a834c79a5fd7c2a93c1054f583b1- Machine
- AMD64
- Version
- 7.00 (Build 5517)
- Publisher
- GE Intelligent Platforms, Inc.
GEDevDrv.SYSSample 2 · HVCI FALSE
- MD5
1793e1d4247b29313325d1462dec81e2- SHA1
cc3186debacb98e0b0fb40ad82816bea10741099- SHA256
a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce- Imphash
c7912c850407aa93c979d95c4f593507- Authentihash MD5
35c40570f78b1562c064347f3719bb17- Authentihash SHA1
9f5eaab353bf93697eec55b9fac8479968f17e7c- Authentihash SHA256
8a228c751d1664b362f10dc7083c223995b976b264da8b7380c51157bed66fbe- Machine
- AMD64
- Version
- 9.50 (Build 7677)
- Publisher
- General Electric Company
GEDevDrv.SYSSample 3 · HVCI FALSE
- MD5
62f8d7f884366df6100c7e892e3d70bf- SHA1
8589a284f1a087ad5b548fb1a933289781b4cedc- SHA256
ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc- Imphash
5f9cf5b0511f3c1129b467d273b921f2- Authentihash MD5
c2066a8850532d5609348012e72715fa- Authentihash SHA1
a236f58a6e3c596360078b96966416a1c66c87d7- Authentihash SHA256
d9cbdfc10ba743d5229f7dbb6507b9864012fb58cb253da92962dc611603a73c- Machine
- I386
- Version
- 9.50 (Build 7677)
- Publisher
- General Electric Company
GEDevDrv.SYSSample 4 · HVCI FALSE
- MD5
328a2cb2da464b0c2beb898ff9ae9f3a- SHA1
adf9328e60c714ff0b98083bcf2f4ee2d58b960b- SHA256
cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461- Imphash
5f9cf5b0511f3c1129b467d273b921f2- Authentihash MD5
ac9499fe14d8b42cda567660f3d081df- Authentihash SHA1
30d5627753948f533ef45636a0a845d1accd82e3- Authentihash SHA256
1dcdd1efab9abc25f4227b37f76da295a6dc4cf810875ba34ee1d465eb709b70- Machine
- I386
- Version
- 7.00 (Build 5517)
- Publisher
- GE Intelligent Platforms, Inc.
Recorded command
sc.exe create GEDevDrvSYS binPath= C:\windows\temp\GEDevDrvSYS.sys type=kernel && sc.exe start GEDevDrvSYSElevate privileges · Privileges: kernel · OS: Windows 10