← Back to driver explorer
Driver intelligenceVulnerableVerified
dellbios.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 11
5 recorded TRUE · 6 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
dellbios.sysSample 1 · HVCI TRUE
- MD5
fe937e1ed4c8f1d4eac12b065093ae63- SHA1
4f02fb7387ca0bc598c3bcb66c5065d08dbb3f73- SHA256
0584520b4b3bdad1d177329bd9952c0589b2a99eb9676cb324d1fce46dad0b9a- Imphash
a9e22f5e8f4965960716d94ba7639c9f- Authentihash MD5
c7c7df2ad7431960cac0875dd12c85cf- Authentihash SHA1
7b8c480f527d76880037739b1b25e94efbb2f9ae- Authentihash SHA256
51859571d807d984e4f1cf145d5d74491feabd19327309c2c598c496a1976c70- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 2 · HVCI FALSE
- MD5
0215d0681979987fe908fb19dab83399- SHA1
724dde837df2ff92b3ea7026fe8a0c4e5773898f- SHA256
163912dfa4ad141e689e1625e994ab7c1f335410ebff0ade86bda3b7cdf6e065- Imphash
10917aa77669c6ae714f074d89be9ab8- Authentihash MD5
1c1b634a312794371abfac3d67e1eca6- Authentihash SHA1
a5f8e8044e4add00fef7f43725c8e6e121ba0e6a- Authentihash SHA256
e2b6350e17e9b24b7140eed743b4ae0b01453bbb8cb73b091b51e2306017d80f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 3 · HVCI TRUE
- MD5
16a8e8437b94d6207af2f25fd4801b6d- SHA1
9e8a87401dc7cc56b3a628b554ba395b1868520f- SHA256
2288c418ddadd5a1db4e58c118d8455b01fd33728664408ce23b9346ae0ca057- Imphash
10917aa77669c6ae714f074d89be9ab8- Authentihash MD5
bebca66f8c5c2f34e2dc07b90c3b27fe- Authentihash SHA1
70c3aa0e20ceb094f72b53ef4228c62d884a7232- Authentihash SHA256
f9db97bd12d2d734ccd86045bae1fd5fbeed106ba5cfa519e6fcd9093c1c04a6- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 4 · HVCI FALSE
- MD5
c04a5cdcb446dc708d9302be4e91e46d- SHA1
7c46ecc5ce8e5f6e236a3b169fb46bb357ac3546- SHA256
3678ba63d62efd3b706d1b661d631ded801485c08b5eb9a3ef38380c6cff319a- Imphash
e7cbb1ce75bfc69f53855066a936042d- Authentihash MD5
e03a33bd4f099f5d493030b040eeabfd- Authentihash SHA1
280fcedfe4013a14bf122a917ae2fa469142714c- Authentihash SHA256
ee067313bd75acae24e1661cb6807ed6148f9af34542ed77578144b21f5c8da1- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 5 · HVCI TRUE
- MD5
2d64d681d79e0d26650928259530c075- SHA1
fc154983af4a5be15ae1e4b54e2050530b8bc057- SHA256
5449e4dd1b75a7d52922c30baeca0ca8e32fe2210d1e72af2a2f314a5c2268fb- Imphash
1957e33acbc826c69f452ae1d1b89ac9- Authentihash MD5
8f2101c5eeaa09c79656ec7e6edc4d5b- Authentihash SHA1
0da8d2776086079a96bef45383c53c9091e0432e- Authentihash SHA256
be589c5c853c86703e23e3b77455bd0d4330bd5e612d0af538f98cc3c4cec1b4- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 6 · HVCI FALSE
- MD5
8a70921638ff82bb924456deadcd20e6- SHA1
a88546fb61a2fa7dab978a9cb678469e8f0ed475- SHA256
5bf3985644308662ebfa2fbcc11fb4d3e2a0c817ad3da1a791020f8c8589ebc8- Imphash
10917aa77669c6ae714f074d89be9ab8- Authentihash MD5
fbb107d4b7088fa529edcf9a27b4499b- Authentihash SHA1
808b0de6f644d48c4ed0c9b607a17362ec3df083- Authentihash SHA256
b8e047a7c96a94eb7cf0416253eca48fa7ba66914b684ee75e81651c83c7ac30- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 7 · HVCI FALSE
- MD5
c37b575c3a96b9788c26cefcf43f3542- SHA1
f7413250e7e8ad83c350092d78f0f75fcca9f474- SHA256
6575ea9b319beb3845d43ce2c70ea55f0414da2055fa82eec324c4cebdefe893- Imphash
be69e763a6a858c3e7e1ea6e3af12691- Authentihash MD5
a1c36e75bb10e6010531223ab5141ae7- Authentihash SHA1
ac1d5f3691326940bb3cb471097296ff7d21dc9b- Authentihash SHA256
419b5bca6d43650893d5e044e785c0ad87cbe1185de0d3feaa9f681c6e7f50b4- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 8 · HVCI FALSE
- MD5
f4a31e08f89e5f002ef3cf7b1224af5f- SHA1
c2d18ce26ce2435845f534146d7f353b662ad2b9- SHA256
700b9839fde53e91f0847053b4d2eb8d9bd3aca098844510f1fa3bab6a37eb24- Imphash
10917aa77669c6ae714f074d89be9ab8- Authentihash MD5
685227232e3e50d40eedef9afdb000aa- Authentihash SHA1
03952b6ddcdfc4a2ab375dce0475cea07113ad36- Authentihash SHA256
7c62a659a4f8fdecfd5a64f4f4391852996db564d123fc5d20e3f3dfb11ed62c- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 9 · HVCI TRUE
- MD5
51c233297c3aa16c4222e35ded1139b6- SHA1
0ff2ad8941fbb80cbccb6db7db1990c01c2869b1- SHA256
a6c11d3bec2a94c40933ec1d3604cfe87617ba828b14f4cded6cfe85656debc0- Imphash
edc2197e927392567cf09f7de410b5bb- Authentihash MD5
afd1f043a2f346f1349131e0db185805- Authentihash SHA1
586987aba0aed6f989588f7e852260aab2679332- Authentihash SHA256
03df432d7ff56ed53fd050b1875f5a05dffbe1c999adf2dd6c8d790b7ffd2c2d- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 10 · HVCI FALSE
- MD5
1a5a95d6bedbe29e5acf5eb6a727c634- SHA1
c1777fcb7005b707f8c86b2370f3278a8ccd729f- SHA256
b3a191ccd1df19cdf17fe6637d48266ac84c4310b013ad6973d8cb336b06ff69- Imphash
be69e763a6a858c3e7e1ea6e3af12691- Authentihash MD5
a1c36e75bb10e6010531223ab5141ae7- Authentihash SHA1
ac1d5f3691326940bb3cb471097296ff7d21dc9b- Authentihash SHA256
419b5bca6d43650893d5e044e785c0ad87cbe1185de0d3feaa9f681c6e7f50b4- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
dellbios.sysSample 11 · HVCI TRUE
- MD5
637cf50b06bc53deae846b252d56bbdc- SHA1
be270d94744b62b0d36bef905ef6296165ffcee9- SHA256
b84dc9b885193ced6a1b6842a365a4f18d1683951bb11a5c780ab737ffa06684- Imphash
6b867dee14a77d0ada8ccad99b16291e- Authentihash MD5
275dc7c2ad082fb91ce22e5c327fe6d4- Authentihash SHA1
53b69917a6aed8b1a309fc2de63f37f5f1062af7- Authentihash SHA256
8fe475d3082a0226ae9fa945542ac3e0cb5214c0f44193dcff12514cadf52101- Machine
- I386
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create dellbiossys binPath= C:\windows\temp\dellbiossys.sys type=kernel && sc.exe start dellbiossysElevate privileges · Privileges: kernel · OS: Windows 10