{"Id":"be1a3216-73db-46e4-b107-87d9b7751181","Tags":["pxscan.sys"],"Verified":"TRUE","Author":"wwwab123, Michael Haag","Created":"2026-09-18","MitreID":"T1562.001","CVE":["CVE-2025-60349"],"Category":"vulnerable driver","Commands":{"Command":"","Description":"The legacy Prevx Scanner driver pxscan.sys 3.0.5.220 processes configurable file targets under its service's Files registry key when IOCTL 0x22E044 is requested. Static analysis confirms that the worker can delete selected files and terminate matching processes from kernel context. The process termination behavior is documented as CVE-2025-60349. The reviewed device uses FILE_DEVICE_SECURE_OPEN and a security descriptor granting full access only to LocalSystem and Builtin Administrators; modifying the service registry configuration also requires appropriate privileges. This is an administrator/SYSTEM-gated BYOVD primitive, not a standard-user privilege escalation. Protected-process termination was not tested locally.","Usecase":"Delete files and terminate processes to impair security controls.","Privileges":"Administrator or LocalSystem with device access and service-registry write access.","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/429","https://github.com/wwwab123/pxscan_ZwDeleteFile_ZwTerminateProcess_BSOD_BYOVD","https://github.com/djackreuter/CVE-2025-60349","https://blog.shellntel.com/p/finding-an-undiscovered-process-termination-vulnerability-in-a-15-year-old-antivirus-driver","https://www.cve.org/CVERecord?id=CVE-2025-60349","https://cveawg.mitre.org/api/cve/CVE-2025-60349"],"Acknowledgement":{"Person":"wwwab123, djackreuter (Shellntel)","Handle":"@wwwab123, @djackreuter"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"pxscan.sys","SHA256":"b854c4c2c860b8cf00808ba07b9ebbfff66d483b8a2aa15a94211e57b84ee1f2","MD5":"66d4d00c8908888a68b749d91f1e6789","SHA1":"d2bdcc6eddeb23af6bf7263c93a1cdef1f0a1f3a","Imphash":"f337527131e256c7ebd56c4389597242","Authentihash":{"MD5":"2c46be7fcbc3d20adaa55cd4a7135710","SHA1":"8d3b12f1c9324b025c1de7aa00844d73a9de7d3e","SHA256":"6fac3bc346399255c63792f19a2c9b4983b5d4fa3f4da64764870f0f2489d920"},"RichPEHeaderHash":{"MD5":"630a474ab7ed3cf63acb3e862d3534ed","SHA1":"064270ec61ca46113bc5e49cd49e9d56d0a7ff8f","SHA256":"c4f9997c7d18616adbddfe24c1969c12f1b783d2f569f1c944d4ee0c21c09e4f"},"Sections":{".text":{"Entropy":5.973073555838383,"Virtual Size":"0x272e"},".rdata":{"Entropy":4.369152714023908,"Virtual Size":"0xd58"},".data":{"Entropy":1.3569809583380914,"Virtual Size":"0x330"},".pdata":{"Entropy":4.250072156694568,"Virtual Size":"0x384"},"PAGE":{"Entropy":6.205537674715251,"Virtual Size":"0x19f7"},"INIT":{"Entropy":5.127147485191859,"Virtual Size":"0x8b0"},".rsrc":{"Entropy":3.317925727432824,"Virtual Size":"0x338"},".reloc":{"Entropy":1.834394703611725,"Virtual Size":"0x84"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2010-11-25 16:05:14","Description":"Prevx Scanner","Company":"Prevx","InternalName":"pxscan.sys","OriginalFilename":"pxscan.sys","FileVersion":"3.0.5.220 built by: WinDDK","Product":"Prevx 3.0","ProductVersion":"3.0.5.220","Copyright":"(c) Prevx Ltd. 2010","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","IoGetDeviceObjectPointer","ObfDereferenceObject","NtBuildNumber","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","ExFreePoolWithTag","ZwQuerySystemInformation","IoBuildSynchronousFsdRequest","KeInitializeEvent","KeWaitForSingleObject","IofCallDriver","PsLookupProcessByProcessId","KeUnstackDetachProcess","ObQueryNameString","ZwClose","ObReferenceObjectByHandle","ZwOpenProcess","ZwTerminateProcess","KeStackAttachProcess","RtlIntegerToUnicodeString","RtlCheckRegistryKey","RtlAppendUnicodeToString","ZwSetInformationFile","KeDelayExecutionThread","ZwCreateFile","PsCreateSystemThread","PsTerminateSystemThread","RtlWriteRegistryValue","ZwDeleteFile","RtlCopyUnicodeString","RtlUnicodeStringToInteger","RtlDeleteRegistryValue","RtlUpcaseUnicodeChar","ZwQueryValueKey","ZwDeleteKey","ZwOpenKey","ZwQueryInformationProcess","IoDeleteDevice","ZwSetValueKey","KeBugCheck","IofCompleteRequest","IoCreateSymbolicLink","KeBugCheckEx","IoCreateDevice","ObOpenObjectByPointer","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","wcschr","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","ZwCreateKey","RtlFreeUnicodeString","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2006-11-08 00:00:00","ValidTo":"2021-11-07 23:59:59","Signature":"a3cd7d1ef7c7758d48e756344c009075a951a556c16dbcfef55322e998a2ac9a7e701eb38e3b45e3869531da6d4cfb34508096cd24f240df043fe265ce34226115ea667064d2f16ef3ca18596a41467e82de19b0703156690d0ce61d9d7158dcccde62f5e17a1002d87adc3bfa57bdc9e98f4621399f51654c8e3abe2841701d","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"1b093b786096da37bba4519446c89678","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"13a167a548f4915921fc4381cad99605","SHA1":"8b61bb2b0c4cd1eba78f1bc0cd3b8b018269cf30","SHA256":"28a75b684ecd8b81b9327d3d3d37eaa56a4630c84dc2e3fade6b663729c86ef5","SHA384":"501cca63f378c1234b97d12974f6c883408a006a592b1fa6b1ae7721c0dc211534d5e4b7d9e1fac574c5f7de82684ec0"}},{"Subject":"C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority","ValidFrom":"2006-05-23 17:01:29","ValidTo":"2016-05-23 17:11:29","Signature":"01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610c120600000000001b","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"53c41bc1164e09e0cd1617a5bf913efd","SHA1":"93c03aac8951d494ecd5696b1c08658541b18727","SHA256":"40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b","SHA384":"f51d4e75ba638f7314cd59b8d6d45f3b34d35ce6986e9d205cd6f333e8e8d8e9c91f636e6bc84731b6661673f40963d8"}},{"Subject":"C=GB, ST=Derby, L=Derby, O=Prevx, OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Prevx","ValidFrom":"2010-10-19 00:00:00","ValidTo":"2013-11-26 23:59:59","Signature":"8bdb60f9676632b47f1bfac2522d957846d82102bbbed1d9e06ded08fca82861e3e6a522cb6854c80f900d36ede05b2049e57ce09dd08876c60d708af62ba9b670b49fb160035472af4d810ffed64c0ee10ed47ffb80ba25f1997347fb610ffa8ad78821812f429c74c80826d3d2e5fe78ccf3dd5ce83a321e5d5eba90540aa16193b17960dcdcfbbce6c8624d3aac101bcdeb99af0f94e5473de549f11f1df7738be0a11ac44acbb52751fafa22bedd7debe807b99899ef029c9719e87c1375da95429c7d5b363b15c60b244c625c4082fb840fb57e92371df356fc396f1306bfa258f0ee79860a963fc752cebd122b4202b99bb9d643df7a79203dd3b03c18","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"46a5fc45fe2c55bcede65c8883fbb6f8","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"c29f855d429867c7c79ea130613fb7ad","SHA1":"edcbbe791dd85b47069868c6a3d058ecacb10502","SHA256":"b5b6565ebe4866940551c04cbf1789a1f650f7d1380704ee6bfce7f0298401bd","SHA384":"a98aa2652efaaa1b995512d842eec9e762882627d0fcfe3b1173156b9cfe4a1c4357fb15a155fcbe8247c5f837dcd471"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"46a5fc45fe2c55bcede65c8883fbb6f8","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"Signature":["Prevx"]}]}