← Back to driver explorer
Driver intelligenceVulnerableVerified
atlAccess.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
atlAccess.sysSample 1 · HVCI FALSE
- MD5
08001b0cdb0946433366032827d7a187- SHA1
6b54b8f7edca5fb25a8ef1a1d31e14b9738db579- SHA256
0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57- Imphash
8b47d6faba90b5c89e27f7119c987e1a- Authentihash MD5
b9bac046427a6f1664a5af4baebd3a61- Authentihash SHA1
c5d83d40db80c87b370af91c67713658c6ae0a79- Authentihash SHA256
c25cb17f5879e9c2fb4c91adb18e24b50a94738d5deb62a4189065bcf2c1d86b- Machine
- AMD64
- Version
- 6.1.7600.16385 built by: WinDDK
- Publisher
- Windows (R) Win 7 DDK provider
Recorded command
sc.exe create atlAccesssys binPath= C:\windows\temp\atlAccesssys.sys type=kernel && sc.exe start atlAccesssysElevate privileges · Privileges: kernel · OS: Windows 10