nvflash.sys
NVIDIA Flash Driver, Version 1.8.0 file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2a6a38ca-f2e6-456e-9ccf-db59d8c80c9e/
https://www.loldrivers.io/drivers/d55a5955-6220-4f38-ba7d-91339330fe98/
https://www.loldrivers.io/drivers/d55a5955-6220-4f38-ba7d-91339330fe98/
9 known samples
1.8.0 · its entry
afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e025080a89a6ab2fca486480b6e3dacf392d6ce0c59a5bdb4bcd18d672feb4ebb0543c159dcf37dc723d6db2bad46ed6a1b0e31d72390ec298a5413c7be318aef4a2411e9ec6b3e83055ae90f3664a083c46885c506d33de5e2a49f5f1189e89fa9f0a3b2ad08123e8ed2516548240cfcdf5eefd89293f31070a6cd3949ee1b66fed14423d58265b22504f512a84faf787c1af17c44445ae68f7adcaa68b6f970e7bd54737750788c72d2fc9cf95681c622357263075d65b23e54c4dc3f31446cad37b9368e51ec98e2ad20893a5fc21e6a8b20c5bee158d5c49ca58649cff84db9d68f1fbec90c60ee4daba1b35932db9f3556633b2777b1039163841a91cf997938eFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real nvflash.sys?
ProductNVIDIA Flash Driver, NVIDIA Corporation
DescriptionNVIDIA Flash Driver, Version 1.8.0
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names nvflash.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.