CmdID

CmdID / Files

gdrv.sys

GIGABYTE Tools file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2bea1bca-753c-4f09-bc9f-566ab0193f4a/
https://www.loldrivers.io/drivers/613b8509-18c0-4720-b489-736776b6713e/

13 known samples

Show the 13 samples’ SHA-256 hashes

5.2.3790.1830 built by: WinDDK · its entry

17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229

5.2.3790.1830 built by: WinDDK · its entry

31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427

5.2.3790.1830 built by: WinDDK · its entry

6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38

5.2.3790.1830 built by: WinDDK · its entry

88992ddcb9aaedb8bfcc9b4354138d1f7b0d7dddb9e7fcc28590f27824bee5c3

5.00.2195.1620 · its entry

cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b

5.00.2195.1620 · its entry

f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b

1.1.0.1 · its entry

81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0

1.0.1.3 · its entry

133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743

1.0.1.1 · its entry

092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0

1.0.1.1 · its entry

0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c

1.0.0.5 · its entry

26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097

1.0.0.1 · its entry

8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2

1.0.0.1 · its entry

ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real gdrv.sys?

file version info and known copies
ProductWindows (R) Server 2003 DDK driver, Windows (R) Server 2003 DDK provider
DescriptionGIGABYTE Tools

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names gdrv.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.