VBoxUSB.Sys

VirtualBox USB driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/5938df1d-9513-449f-8252-c442ddca0c2a/
https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/

3 known samples

1.01 · its entry

5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291

1.01 · its entry

c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa

its entry

6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real VBoxUSB.Sys?

file version info and known copies

ProductVirtualBox USB driver, innotek GmbH

DescriptionVirtualBox USB driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names VBoxUSB.Sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.