asio.sys
AsIO3 Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
18 known samples
Show the 18 samples’ SHA-256 hashes
0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d620e52e0d7f579dc6884cc6e80266fddceda69ea5fdd0b095c0874b0d877e48a22d36642135166bbb296624dca878925963c7da785e42e940f02d01beb7c477d52da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e41765151df57125286b398cc107ff8007972f4653527f876d133dac1548865d6436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e748891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce2852a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15707b4b5f5c4585156d8a4d8c39cf26729f5ad05d7f77b17f48e670e808e3e6a0923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782b3e645e8817696fa5d5e2255f9328f3b6a2e5fce91737f4d654ff155dc9851e5b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2ce231637422709d927fb6fa0c4f2215b9c0e3ebbd951fb2fa97b8e64da479b96d374f143dcfc1817fce11226a30653aa2bb7bf9d36ff58d289ff8c0199e4fc3fdb73b0fa032be22405fa0b52fbfe3b30e56ac4787e620e4854c32668ae43bc33dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real asio.sys?
ProductAsIO3, Asustek Computer Inc.
DescriptionAsIO3 Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names asio.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.