Randgrid.sys - Malicious (88/100) - DriverShield Analysis

Analysis of Randgrid.sys: malicious verdict, risk score 88/100. 6 YARA matches, 0/75 multi-engine detections. SHA256 452e46ff38ac24d5. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

Randgrid.sys - Analysis Report

DriverShield analyzed the Windows kernel driver Randgrid.sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).

VerdictMalicious (88/100)
YARA matches6
Multi-engine detections0 / 75
File size9684248 bytes
Code-signing signerActivision Publishing Inc
Analyzed2026-08-20
SHA256452e46ff38ac24d5c4763873430770cd680ba0b472a903c7b05641d8173e13cd
SHA1592b6c03f781b60d57944484899b76942818a4f2
MD5381ac02197f3076fc6829163b19b0ead

Driver identity

Version resource data embedded in the Randgrid.sys PE header, as extracted by the analysis engine.

File descriptionRandgrid Driver
ProductRandgrid Driver
CompanyActivision Blizzard, Inc.
Original filenameRandgrid.sys
Internal nameRandgrid
File version1.2.0
Copyright(C)2024 Activision Blizzard, Inc.

How the 88/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches100 / 100
Dangerous kernel imports100 / 100
IOCTL dispatch surface100 / 100
Known-vulnerable corpus0 / 100
Code-signing state0 / 100
Packing and entropy80 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

Kernel imports (52)

Kernel-mode APIs resolved from the Import Address Table of Randgrid.sys, ranked by exploitation relevance.

APIRiskWhy it matters
MmMapIoSpacecriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwTerminateProcesscriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwMapViewOfSectioncriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwOpenProcesshighPotentially dangerous - could be used for privilege escalation or security bypass
MmAllocateContiguousMemorySpecifyCachehighPotentially dangerous - could be used for privilege escalation or security bypass
PsSetCreateProcessNotifyRoutineExhighPotentially dangerous - could be used for privilege escalation or security bypass
PsSetCreateProcessNotifyRoutinehighPotentially dangerous - could be used for privilege escalation or security bypass
MmAllocateContiguousMemoryhighPotentially dangerous - could be used for privilege escalation or security bypass
MmGetSystemRoutineAddresshighPotentially dangerous - could be used for privilege escalation or security bypass
ObRegisterCallbackshighPotentially dangerous - could be used for privilege escalation or security bypass
PsLookupProcessByProcessIdhighPotentially dangerous - could be used for privilege escalation or security bypass
MmGetPhysicalAddresshighPotentially dangerous - could be used for privilege escalation or security bypass
ZwWriteFilemediumModerate risk - system modification capability
IoGetDeviceObjectPointermediumModerate risk - system modification capability
PsSetLoadImageNotifyRoutinemediumModerate risk - system modification capability
ZwCreateKeymediumModerate risk - system modification capability
ZwQuerySystemInformationmediumModerate risk - system modification capability
ObReferenceObjectByHandlemediumModerate risk - system modification capability
ZwSetInformationFilemediumModerate risk - system modification capability
ZwDeleteKeymediumModerate risk - system modification capability
ObOpenObjectByPointermediumModerate risk - system modification capability
PsSetCreateThreadNotifyRoutinemediumModerate risk - system modification capability
MmUnmapIoSpacemediumModerate risk - system modification capability
KeBugCheckExmediumModerate risk - system modification capability
ZwSetValueKeymediumModerate risk - system modification capability
IoDeleteDevicelowStandard kernel API - generally benign
KeSetEventlowStandard kernel API - generally benign
ExFreePoollowStandard kernel API - generally benign

Showing the 28 highest-relevance imports of 52 resolved.

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x0022840FhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #259
0x0080A987highMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #2657
0x0022850FhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #323
0x0034577BhighMETHOD_NEITHERFILE_DEVICE_DISK Function #1502
0x0022D06FhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #1051
0x0034850FhighMETHOD_NEITHERFILE_DEVICE_DISK Function #323
0x0034840FhighMETHOD_NEITHERFILE_DEVICE_DISK Function #259
0x0080D733highMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #1484
0x0034EA4BhighMETHOD_NEITHERFILE_DEVICE_DISK Function #2706
0x0034E6EBhighMETHOD_NEITHERFILE_DEVICE_DISK Function #2490
0x00224AC3highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #688
0x0080840FhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #259
0x00228EA7highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #937
0x0080860FhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #387
0x002242E3highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #184
0x0080E96BhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #2650
0x0022E903highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #2624
0x0034860FhighMETHOD_NEITHERFILE_DEVICE_DISK Function #387
0x0080250BhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #2370
0x0034E3FFhighMETHOD_NEITHERFILE_DEVICE_DISK Function #2303
0x0022860FhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #387
0x0022E6FFhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #2495
0x002287A7highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #489
0x9C40F5EFhighMETHOD_NEITHERCUSTOM_LENOVO Function #3451

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0x84AE000x84AE006.5CODE, EXEC, READ
.rdata0x30000x30004.4IDATA, READ, WRITE
.data0xD8E000xD8E007.55IDATA, READ, WRITE
.pdata0x04000x04006.33IDATA, READ, WRITE
INIT0x5A000x5A005.35CODE, EXEC, READ
.rsrc0x04000x04003.72IDATA, READ, WRITE
.reloc0x02000x02007.28IDATA, READ, WRITE
.text0xA2000xA2007.14CODE, EXEC, READ

Exploit mitigations

Control Flow GuardEnabled
ASLREnabled
DEPEnabled
Integrity checkEnforced
Mitigation score100 / 100

YARA rule matches (6)

RuleSeverityDetects
BYOVD_MemRWcriticalPhys memory mapping + device creation
BYOVD_ProcKillcriticalProcess termination EDR killer
SUSP_PhysMemhighPhysical memory mapping
SUSP_CallbacksmediumKernel callback registration
MAL_EDRKillercriticalGeneric EDR killer pattern
MAL_DSEBypasscriticalDSE bypass attempt

MITRE ATT&CK techniques (17)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1003OS Credential DumpingCredential Access
T1003.001OS Credential Dumping: LSASS MemoryCredential Access
T1006Direct Volume AccessDefense Evasion
T1014RootkitDefense Evasion
T1055.001Process Injection: DLL InjectionDefense Evasion
T1055.012Process HollowingDefense Evasion
T1068Exploitation for Privilege EscalationPrivilege Escalation
T1071Application Layer ProtocolCommand and Control
T1211Exploitation for Defense EvasionDefense Evasion
T1489Service StopImpact
T1543.003Windows ServicePersistence
T1553.002Subvert Trust Controls: Code SigningDefense Evasion
T1562.001Disable/Modify ToolsDefense Evasion
T1562.006Indicator BlockingDefense Evasion
T1564.001Hidden Files and DirectoriesDefense Evasion
T1569.002Service ExecutionExecution
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerActivision Publishing Inc
Signer organisationActivision Publishing Inc
IssuerDigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
SerialD05163C76AB50EBDB0C4674516017B6
Valid from2024-08-26 00:00 UTC
Valid until2027-08-28 23:59 UTC
Signature validityVerified

Symbolic execution

Engine angr, status completed, 100 paths explored at a maximum depth of 100. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about Randgrid.sys

Is Randgrid.sys safe?

Based on DriverShield static and dynamic analysis, Randgrid.sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.

What is the risk score of Randgrid.sys?

Randgrid.sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 452e46ff38ac24d5c4763873430770cd680ba0b472a903c7b05641d8173e13cd.

What is Randgrid.sys?

Randgrid.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Activision Publishing Inc.

Related: Other drivers signed by Activision Publishing Inc · What an IOCTL dispatch code is · How YARA matching feeds the score · BYOVD research index · full driver database · CVE library · code signing atlas


DriverShield © 2025-2026 · Terms · Privacy · Contact