← Back to driver explorer
Driver intelligenceVulnerableVerified
FH-EtherCAT_DIO.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 2
1 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
FH-EtherCAT_DIO.sysSample 1 · HVCI TRUE
- MD5
eb0a8eeb444033ebf9b4b304f114f2c8- SHA1
b8d19cd28788ce4570623a5433b091a5fbd4c26d- SHA256
8001d7161d662a6f4afb4d17823144e042fd24696d8904380d48065209f28258- Imphash
69163e5596280d3319375c9bcd4b5da1- Authentihash MD5
3fac9a0418f2319fc1b9ddc3fddde14f- Authentihash SHA1
f003d1d1abbb02b0b338aefdca8ea31b92e6b616- Authentihash SHA256
039f442ffbda7decaaf1e367db6fc6f28cc73d549527ef5bedf2be8badedbfd7- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
FH-EtherCAT_DIO.sysSample 2 · HVCI FALSE
- MD5
5c55fcfe39336de769bfa258ab4c901d- SHA1
170a50139f95ad1ec94d51fdd94c1966dbed0e47- SHA256
ae71f40f06edda422efcd16f3a48f5b795b34dd6d9bb19c9c8f2e083f0850eb7- Imphash
68a12eb3f32f7e193bd0d722ea6be4ab- Authentihash MD5
48d0dc0f0c7f19a4ad4f923af1b971fd- Authentihash SHA1
364f53ed52e121182be0e0a21c17c2254894713d- Authentihash SHA256
5e7b92e6a1f656a70ed56ef2a190fce6bb3f12063b891fbfd722ca4e951de15f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create FH-EtherCAT_DIOsys binPath= C:\windows\temp\FH-EtherCAT_DIOsys.sys type=kernel && sc.exe start FH-EtherCAT_DIOsysElevate privileges · Privileges: kernel · OS: Windows 10