b9b835bd-b720-424b-9160-2442bc4d6e58

Blackbone.sys

Description

Confirmed vulnerable driver from Microsoft Block List

UUID: b9b835bd-b720-424b-9160-2442bc4d6e58
Created: 2023-07-22
Author: Michael Haag
Acknowledgement: |

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows

Detections

YARA 🏹

Expand

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c

CVE

Known Vulnerable Samples

Property	Value
Filename
Creation Timestamp	2020-03-26 21:08:39
MD5	a42d87de65d7136620b63d5c4ee017ea
SHA1	b76c3ea60293dae12076ebe5812f53ff85370b78
SHA256	0856a1da15b2b3e8999bf9fc51bbdedd4051e21fab1302e2ce766180b4931d86
Authentihash MD5	7f9d57ffbcd068082faac8c54b36be59
Authentihash SHA1	2a506e2512c9083419b7741b4499e012cdc60204
Authentihash SHA256	d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26
RichPEHeaderHash MD5	a697b11eb161f3e69b3422b3c479f951
RichPEHeaderHash SHA1	4150112a1301e53ca016d7929b5c147c26bb6077
RichPEHeaderHash SHA256	d3c766b8e956c355768b4bb0a12b412ab48d8a89968763785700ab98d8d90da3

Download

Certificates

Expand

Certificate 33000000857f83dc2a6ca979b8000000000085

Field	Value
ToBeSigned (TBS) MD5	85e8c40624a19ac2076dd91f49d8fb53
ToBeSigned (TBS) SHA1	621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca
ToBeSigned (TBS) SHA256	442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
ValidFrom	2019-06-05 18:06:32
ValidTo	2020-06-03 18:06:32
Signature	11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	33000000857f83dc2a6ca979b8000000000085
Version	3

Certificate 610baac1000000000009

Field	Value
ToBeSigned (TBS) MD5	a569061297e8e824767dbc3184a69bea
ToBeSigned (TBS) SHA1	adbb26a587a8f44b4fccaecb306f980d1c55a150
ToBeSigned (TBS) SHA256	cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
ValidFrom	2012-04-18 23:48:38
ValidTo	2027-04-18 23:58:38
Signature	5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	610baac1000000000009
Version	3

Imports

Expand

NETIO.SYS
ntoskrnl.exe

Imported Functions

Expand

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister
RtlUnicodeStringToInteger
RtlInitAnsiString
RtlInitUnicodeString
DbgPrintEx
RtlGetVersion
KeInitializeGuardedMutex
ExAllocatePoolWithTag
ExFreePoolWithTag
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
RtlInitializeGenericTableAvl
RtlCompareString
PsSetCreateProcessNotifyRoutine
IoCreateFileEx
MmFlushImageSection
ZwDeleteFile
RtlImageNtHeader
IoFileObjectType
IofCompleteRequest
DbgPrint
KeDelayExecutionThread
KeQueryTimeIncrement
ExAllocatePool
ProbeForRead
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoGetDeviceObjectPointer
RtlRandomEx
KeStackAttachProcess
KeUnstackDetachProcess
PsIsThreadTerminating
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
__C_specific_handler
RtlImageDirectoryEntryToData
RtlCompareUnicodeString
KeWaitForSingleObject
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
PsWrapApcWow64Thread
ObReferenceObjectByHandle
PsGetCurrentThreadId
PsGetProcessId
PsLookupThreadByThreadId
ZwWaitForSingleObject
ZwQuerySystemInformation
ZwQueryInformationThread
PsGetProcessPeb
PsGetProcessWow64Process
PsGetCurrentProcessWow64Process
KeTestAlertThread
KeInitializeApc
KeInsertQueueApc
PsThreadType
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
RtlFreeUnicodeString
KeResetEvent
ZwCreateFile
RtlDowncaseUnicodeString
ZwQueryInformationProcess
KeAcquireGuardedMutex
KeReleaseGuardedMutex
_stricmp
MmGetSystemRoutineAddress
RtlCaptureContext
KeCapturePersistentThreadState
RtlEqualUnicodeString
MmProbeAndLockPages
MmUnlockPages
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableAvl
RtlIsGenericTableEmptyAvl
PsGetCurrentProcessId
MmCopyVirtualMemory
KeInitializeEvent
KeSetEvent
IoAllocateIrp
IoFreeIrp

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
INIT
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Signature": "11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "85e8c40624a19ac2076dd91f49d8fb53",
        "SHA1": "621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca",
        "SHA256": "442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a",
        "SHA384": "19b80fb83482cdb42c94c2eabac29e4db7777988905aab348bd7ed62e325d2ea1f4c80df0d7275abcb2b67585cfc7c36"
      },
      "ValidFrom": "2019-06-05 18:06:32",
      "ValidTo": "2020-06-03 18:06:32",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "610baac1000000000009",
      "Signature": "5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "TBS": {
        "MD5": "a569061297e8e824767dbc3184a69bea",
        "SHA1": "adbb26a587a8f44b4fccaecb306f980d1c55a150",
        "SHA256": "cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46",
        "SHA384": "e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"
      },
      "ValidFrom": "2012-04-18 23:48:38",
      "ValidTo": "2027-04-18 23:58:38",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "SerialNumber": "33000000857f83dc2a6ca979b8000000000085",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-09-26