Driver intelligenceVulnerableVerified

ampa.sys

Northwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.

UUID / ea0e7351-b65c-4c5a-9863-83b9d5efcec3ADDED / 2024-09-11AUTHOR / Northwave Cyber Security

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ampa.sysSample 1 · HVCI TRUE

MD5: d0c50c113fe59c21ad59932e6b9c202f
SHA1: 41ff9cf9091fef6da6dfa3279310655a84ed5845
SHA256: 01d51df682136cce453bb1da8964073e6bc7297ce4dae7301c753bb618a69469
Imphash: e54cb614fcaa06fed22c681d4526d8bf
Authentihash MD5: d08b5fabcd47f8dac29c560649573a49
Authentihash SHA1: b503a13858755b769fa47d94ad5dccface9a4ee6
Authentihash SHA256: fcae081ec5093f2f794e0fe32456a07d2294decea356ba84f5ca7c0af407b671
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create ampa binPath=C:\windows\temp\ampa.sys type=kernel && sc.exe start ampa

Elevate privileges · Privileges: kernel · OS: Windows 10

Acknowledgement: Northwave Cyber Security