CmdID / Files

AMDRyzenMasterDriver.sys

AMD Ryzen Master Service Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/

11 known samples

1.7.0.0 · its entry

4a0d0034f6deabb9369f553d4d9f3a7aa6f87fa8f2292be576d7b42897c686bb

1.7.0.0 · its entry

fac8f441eb645a7572c569eb4150f9b897c71173185e9369a9f7e0bd4bee6cf2

1.5.0.0 · its entry

909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880

1.4.0.0 · its entry

28a5194e1fe92850a0d90e5afaeec5ed57efd3827e2ce99da3803502bc5f4c8d

1.4.0.0 · its entry

ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5

1.3.0.0 · its entry

7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d

1.3.0.0 · its entry

a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433

1.2.0.0 · its entry

f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f

1.1.0.0 · its entry

9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194

1.0.0 · its entry

5c655642fd64e51581d2880cc1a517331b376463e3a85e21ec6e3ed147494a26

1.0.0 · its entry

af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real AMDRyzenMasterDriver.sys?

file version info and known copies

ProductAMD Ryzen Master Service Driver, Advanced Micro Devices

DescriptionAMD Ryzen Master Service Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names AMDRyzenMasterDriver.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.