6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8

kbdcap64.sys :inline

Description

kbdcap64.sys is a vulnerable driver and more information will be added as found.

  • UUID: 6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8
  • Created: 2023-01-09
  • Author: Michael Haag
  • Acknowledgement: |

Commands

sc.exe create kbdcap64.sys binPath=C:\windows\temp\kbdcap64.sys type=kernel && sc.exe start kbdcap64.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

    • Known Vulnerable Samples

    PropertyValue
    Filenamekbdcap64.sys
    Creation Timestamp
    MD5
    SHA1
    SHA25672b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1

    Imports

    Expand

    Imported Functions

    Expand

    Exported Functions

    Expand

    Sections

    Expand

    Signature

    Expand
    PropertyValue
    Filename
    Creation Timestamp2019-11-03 23:10:09
    MD513bd61916343d94ebefc9a7911d7bf88
    SHA144a3a00394a6d233a27189482852babf070ffebe
    SHA25697030f3c81906334429afebbf365a89b66804ed890cd74038815ca18823d626c
    Authentihash MD5038cbc948ff5ba06ac0b54ca31401fe4
    Authentihash SHA183660d245fe618ecafe4900ac1e2ad0292c2da2a
    Authentihash SHA25672b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1
    RichPEHeaderHash MD5a53e7b4810b8e8a6646827967165e841
    RichPEHeaderHash SHA16e089a0ffce20d92395e42c69b619bf59c140999
    RichPEHeaderHash SHA2566d1066a1530eeb73686043235fe52052b0934d77e8e9ee471b0c67bfa61172c5

    Download

    Certificates

    Expand
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 09b92d7a420083c94eaf18145cfaedd1
    FieldValue
    ToBeSigned (TBS) MD562acdecc22447b159a7e2efb0350bd63
    ToBeSigned (TBS) SHA1ddd0bd1dded2c9189fc5b8563f8210deb83c590b
    ToBeSigned (TBS) SHA256ae3a19b6b64e739d5d2abb0e1471874b7d8b6b1e3f1e38ed483166a664355a4e
    Subject??=CN, ??=Shanghai, ??=Private Organization, serialNumber=9131010707118381X9, C=CN, ST=Shanghai, L=Shanghai, O=, CN=
    ValidFrom2019-08-27 00:00:00
    ValidTo2022-08-19 12:00:00
    Signature3a72522da9ea787347ffe4ac96c364ffda35372ea83b3427ca0bb30d1478767ed738daaf84648998b3557ff959565e4000ffadb512d64361834b9ad550365a25a69f95ef9e7a4a38294ae14e9edd1724230f84b35deb1cedb5dc3f53d80ddfe9488df913ce93bf1a3989c325424bc35b601a0e85af646c3d764688e1922ba094b4c0e1de92186f4a0d0c1cad81673f9fca92b58e180101d9215fae80d2d42fe02c20fb1602a1cb72ec472d1d4725f1de0f76849cbd02cb7397920c623dbdebe4ea5d94b273ca1180cc5f29b45cc7c064a1bb7fa22f2d8e8e43d85c5e716481cb7beea87bb70eb5672220cec0ba61f08cbffb48114e48c11b1cdc3a13de5d221a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber09b92d7a420083c94eaf18145cfaedd1
    Version3
    Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06
    FieldValue
    ToBeSigned (TBS) MD5f92649915476229b093c211c2b18e6c4
    ToBeSigned (TBS) SHA12d54c16a8f8b69ccdea48d0603c132f547a5cf75
    ToBeSigned (TBS) SHA2562cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0dd0e3374ac95bdbfa6b434b2a48ec06
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • MmUnmapLockedPages
    • KeClearEvent
    • IoDeleteSymbolicLink
    • ExFreePoolWithTag
    • IoRegisterPlugPlayNotification
    • KeReadStateEvent
    • MmMapLockedPages
    • RtlInitUnicodeString
    • IoDeleteDevice
    • KeSetEvent
    • KeInitializeEvent
    • KeReleaseSpinLock
    • IoDetachDevice
    • MmBuildMdlForNonPagedPool
    • IoFreeMdl
    • IoCancelIrp
    • KeDelayExecutionThread
    • ObQueryNameString
    • IoDriverObjectType
    • wcsstr
    • MmMapLockedPagesSpecifyCache
    • ExInterlockedInsertHeadList
    • ExAllocatePool
    • ExInterlockedInsertTailList
    • PoStartNextPowerIrp
    • IoUnregisterPlugPlayNotification
    • IofCompleteRequest
    • ObReferenceObjectByHandle
    • IoAttachDeviceToDeviceStack
    • PoCallDriver
    • ExInterlockedRemoveHeadList
    • IoCreateSymbolicLink
    • ObfDereferenceObject
    • ObReferenceObjectByName
    • IoCreateDevice
    • DbgPrint
    • IoAllocateMdl
    • IofCallDriver
    • KeAcquireSpinLockRaiseToDpc
    • KeBugCheckEx
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT

    Signature

    Expand
    PropertyValue
    Filename
    Creation Timestamp2019-11-03 23:10:09
    MD591203acddac81511d17a68a030d063a8
    SHA1f5293ac70d75cdfe580ff6a9edcc83236012eaf1
    SHA2560b8887921e4a22e24fd058ba5ac40061b4bb569ac7207b9548168af9d6995e7c
    Authentihash MD5038cbc948ff5ba06ac0b54ca31401fe4
    Authentihash SHA183660d245fe618ecafe4900ac1e2ad0292c2da2a
    Authentihash SHA25672b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1
    RichPEHeaderHash MD5a53e7b4810b8e8a6646827967165e841
    RichPEHeaderHash SHA16e089a0ffce20d92395e42c69b619bf59c140999
    RichPEHeaderHash SHA2566d1066a1530eeb73686043235fe52052b0934d77e8e9ee471b0c67bfa61172c5

    Download

    Certificates

    Expand
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 09b92d7a420083c94eaf18145cfaedd1
    FieldValue
    ToBeSigned (TBS) MD562acdecc22447b159a7e2efb0350bd63
    ToBeSigned (TBS) SHA1ddd0bd1dded2c9189fc5b8563f8210deb83c590b
    ToBeSigned (TBS) SHA256ae3a19b6b64e739d5d2abb0e1471874b7d8b6b1e3f1e38ed483166a664355a4e
    Subject??=CN, ??=Shanghai, ??=Private Organization, serialNumber=9131010707118381X9, C=CN, ST=Shanghai, L=Shanghai, O=, CN=
    ValidFrom2019-08-27 00:00:00
    ValidTo2022-08-19 12:00:00
    Signature3a72522da9ea787347ffe4ac96c364ffda35372ea83b3427ca0bb30d1478767ed738daaf84648998b3557ff959565e4000ffadb512d64361834b9ad550365a25a69f95ef9e7a4a38294ae14e9edd1724230f84b35deb1cedb5dc3f53d80ddfe9488df913ce93bf1a3989c325424bc35b601a0e85af646c3d764688e1922ba094b4c0e1de92186f4a0d0c1cad81673f9fca92b58e180101d9215fae80d2d42fe02c20fb1602a1cb72ec472d1d4725f1de0f76849cbd02cb7397920c623dbdebe4ea5d94b273ca1180cc5f29b45cc7c064a1bb7fa22f2d8e8e43d85c5e716481cb7beea87bb70eb5672220cec0ba61f08cbffb48114e48c11b1cdc3a13de5d221a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber09b92d7a420083c94eaf18145cfaedd1
    Version3
    Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06
    FieldValue
    ToBeSigned (TBS) MD5f92649915476229b093c211c2b18e6c4
    ToBeSigned (TBS) SHA12d54c16a8f8b69ccdea48d0603c132f547a5cf75
    ToBeSigned (TBS) SHA2562cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0dd0e3374ac95bdbfa6b434b2a48ec06
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • MmUnmapLockedPages
    • KeClearEvent
    • IoDeleteSymbolicLink
    • ExFreePoolWithTag
    • IoRegisterPlugPlayNotification
    • KeReadStateEvent
    • MmMapLockedPages
    • RtlInitUnicodeString
    • IoDeleteDevice
    • KeSetEvent
    • KeInitializeEvent
    • KeReleaseSpinLock
    • IoDetachDevice
    • MmBuildMdlForNonPagedPool
    • IoFreeMdl
    • IoCancelIrp
    • KeDelayExecutionThread
    • ObQueryNameString
    • IoDriverObjectType
    • wcsstr
    • MmMapLockedPagesSpecifyCache
    • ExInterlockedInsertHeadList
    • ExAllocatePool
    • ExInterlockedInsertTailList
    • PoStartNextPowerIrp
    • IoUnregisterPlugPlayNotification
    • IofCompleteRequest
    • ObReferenceObjectByHandle
    • IoAttachDeviceToDeviceStack
    • PoCallDriver
    • ExInterlockedRemoveHeadList
    • IoCreateSymbolicLink
    • ObfDereferenceObject
    • ObReferenceObjectByName
    • IoCreateDevice
    • DbgPrint
    • IoAllocateMdl
    • IofCallDriver
    • KeAcquireSpinLockRaiseToDpc
    • KeBugCheckEx
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT

    Signature

    Expand

    source

    last_updated: 2024-09-26