CmdID

CmdID / Files

vboxdrv.sys

VirtualBox Support Driver file version info

Driver on Windows LOLDrivers vulnerable driver 2 Sigma rules name it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/
https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/

14 known samples

Show the 14 samples’ SHA-256 hashes

3.0.0.r49315 · its entry

7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c

2.2.4.r47978 · its entry

c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada

2.2.0.r45846 · its entry

78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f

2.2.0.r45846 · its entry

c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924

1.4.2.119230 · its entry

3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b

1.4.0.119230 · its entry

cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40

1.2.0.137904 · its entry

9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4

1.2.0.119230 · its entry

26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712

its entry

73fddd441a764e808ed6d6b8f3d0d13713e61221aa3cfef7da91cdaf112fe061

its entry

775000c4083c8e4dcfc879d83fcd27b40b46820c9834ae4662861386a4d81fe9

its entry

b50b11e2203942695380869c6072e15479290bc57da2ec5df3481a36b8a8561e

its entry

cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986

its entry

d44848d3e845f8293974e8b621b72a61ec00c8d3cf95fcf41698bbbd4bdf5565

its entry

d998ea6d0051e17c1387c9f295b1c79bacb2f61c23809903445f60313d36c7fd

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real vboxdrv.sys?

file version info and known copies
ProductSun VirtualBox, Sun Microsystems, Inc.
DescriptionVirtualBox Support Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma process creation rules that name vboxdrv.sys
lowVirtualbox Driver Installation or Starting of VMsJanantha Marasinghe

Sigma names vboxdrv.sys in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.