MsIo64.sys

MICSYS IO driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/214654eb-90c4-48c8-a183-0157e50bf07f/
https://www.loldrivers.io/drivers/6d21df78-d718-44df-b722-99eec654f5b2/

6 known samples

1.3 x64 built by: WinDDK · its entry

0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff

1.3 x64 built by: WinDDK · its entry

a7261f13f11c3b845c27cfeeb1cdc6a9400090cebd8e5adbf8c506c1fd9811de

1.3 x64 built by: WinDDK · its entry

ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471

1.3 x64 built by: WinDDK · its entry

d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2

1.2 x64 built by: WinDDK · its entry

cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab

1.1 x64 built by: WinDDK · its entry

43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real MsIo64.sys?

file version info and known copies

ProductMsIo64 Driver Version 1.3, MICSYS Technology Co., LTd

DescriptionMICSYS IO driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names MsIo64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.