{"Id":"c7f94129-f95f-4848-b1ab-68aae24275e7","Tags":["kernel_utility_driver64.sys","kernel_utility_driver32.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-08-28","MitreID":"T1562.001","CVE":[""],"Category":"malicious","Commands":{"Command":"sc.exe create kernel_utility_driver binPath= C:\\windows\\temp\\kernel_utility_driver64.sys type= kernel && sc.exe start kernel_utility_driver","Description":"Huorong Security identified these WHCP-signed kernel drivers in Vaultify rogueware. After a challenge-response exchange, the driver accepts a target driver name and removes process-creation callbacks registered by that driver. This strips callback-based antivirus and EDR visibility from kernel context. Public analysis reproduced the behavior in both the 32-bit and 64-bit builds.","Usecase":"Remove process-creation callbacks registered by antivirus and EDR drivers.","Privileges":"kernel","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/398","https://bbs.huorong.cn/thread-163244-1-1.html","https://github.com/wwwab123/Tjbxld_Drv_CreateProcessCallbacksKiller_BYOVD"],"Detection":[],"Acknowledgement":{"Person":"wwwab","Handle":"@wwwab123"},"KnownVulnerableSamples":[{"Filename":"kernel_utility_driver64.sys","SHA256":"501ea082774f29adc752887402af6df0edf49bf7b3816b93f6e52c06a79685bc","MD5":"180d0b565d76d7e47cc3c9a2901ac2ec","SHA1":"e11e7ee8824e45c25ab638fec6d6e7d4ab89cffa","Imphash":"df691992834a38d3116d3b2a5bd39e29","Authentihash":{"MD5":"1aec6940e814dadb6b348bd31ef12e2e","SHA1":"b88989e61d2de030376b546c400ac6f57a6ada66","SHA256":"52b2a30279b3849123e5eb42ab883372aa807c67b7ffb7f221e6e052ad29e8dc"},"RichPEHeaderHash":{"MD5":"ca8ee7be3d7c20b569d8e9447e6a1f1d","SHA1":"310acb44aad2c5ccf4ea62e003d5a8f56b76031d","SHA256":"599d4960a09a811950b974a93f4958564382b9a9fde0d9b37dd4eea2315d47f9"},"Sections":{".text":{"Entropy":6.3019026296233625,"Virtual Size":"0x2ed6"},".rdata":{"Entropy":4.32488505979853,"Virtual Size":"0x21d4"},".data":{"Entropy":7.31606413508129,"Virtual Size":"0x2798"},".pdata":{"Entropy":4.278046747819361,"Virtual Size":"0x378"},"PAGE":{"Entropy":6.224765622209708,"Virtual Size":"0x1bab"},"INIT":{"Entropy":5.16198034059504,"Virtual Size":"0x700"},".rsrc":{"Entropy":3.3095266931685723,"Virtual Size":"0x2f0"},".reloc":{"Entropy":3.5248991724076317,"Virtual Size":"0x40"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-02-25 02:41:12","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"1,5026,1000,127","Product":"","ProductVersion":"1,5026,1000,127","Copyright":"版权所有 (C) 2010-2026","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["RtlRandomEx","RtlInitUnicodeString","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","_vsnwprintf","IofCompleteRequest","MmGetSystemRoutineAddress","MmIsAddressValid","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","strstr","ExReleaseFastMutex","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","ExAcquireFastMutex","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","KeInitializeEvent","RtlCompareMemory","RtlCopyUnicodeString","RtlIsNtDdiVersionAvailable","ExFreePoolWithTag","RtlGetGroupSecurityDescriptor","ExAllocatePoolWithTag","KeQueryPerformanceCounter","WdfVersionUnbind","WdfVersionBind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-11-13 19:59:40","ValidTo":"2026-11-10 19:59:40","Signature":"7027f4dae4e1916c6c1497dc353dcefdef09044faf0b41df8e9cbf316e9efe85e7d6e013218e8a26fcc429326b9ba45d793be971f810a2d94ac47082bb5746f6791d6852fd1a86680337b65509dfe78631e8f603aef366e2f07716d0c65ed188ca0c748c44979be74293858208351ceb59cae059dc2acaa6050db2822f86570b750dcd892f5972680f4a46d1152c2f7e345bcf3a2dd14cc5aea9099e00d3b8be5b07949ccb72d8b7484b24764e7c29704b1001a7b837daa21c76d690e1cfa99ff7324d2f11fe30cf83b79eaac30a776e64c20831fcc1256199ac86d2cb0e8e39f85a1330f8fbfe4fad14d98323ef9d9f3a452badb2e17326e920d235541e7a1f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d98977d115c14597f0bbce9e377d9d36","SHA1":"3c5bed71f114313ca3ffbe905002568e47a13138","SHA256":"642865a6fb047124c66954823d2726901f6288c2a3a1c9062faad0bdb24f738c","SHA384":"65b73fb035c9d2c72325c92641b097a7cf3c34bbdf43137d18a136988635b7c391e46a68bdae71cbfa0688abb80cd0be"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]},{"Filename":"kernel_utility_driver32.sys","SHA256":"962fb670510807fd5cab3a6e6f886aeb2b925c42054c29fa02f67011be935954","MD5":"1ffa4841ee616cf49b4e439fe131f001","SHA1":"71ab9bd0a43754b1a87cd05a1188cbf27b95b96f","Imphash":"3df5f109bc00887b8230282740059e26","Authentihash":{"MD5":"7641ea013e9045027e6e4d3fd5c091b0","SHA1":"915d533a8ecb1c13fef384dc63845f874084758c","SHA256":"8a9a9e4276f947cfd188fd28daa35bdfae62a2620e90fdd2311096ee1a905fee"},"RichPEHeaderHash":{"MD5":"8af90fc9a2d06bffa76a5ab9460ec831","SHA1":"b33208c53868c1cc16c24723546540f54d21cc1b","SHA256":"9c8933d97d2d66d9ce0569aa3003b187a6abce354693d23b904567aed38d68bb"},"Sections":{".text":{"Entropy":6.396745468719643,"Virtual Size":"0x2300"},".rdata":{"Entropy":3.8701154079634548,"Virtual Size":"0x1854"},".data":{"Entropy":7.295825029973247,"Virtual Size":"0x1fb0"},"PAGE":{"Entropy":6.232442074018103,"Virtual Size":"0x16fe"},"INIT":{"Entropy":5.450281175804367,"Virtual Size":"0x656"},".rsrc":{"Entropy":3.3068671187004877,"Virtual Size":"0x2f0"},".reloc":{"Entropy":6.300907797067297,"Virtual Size":"0x2f0"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-02-25 02:41:18","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"1,5026,1000,127","Product":"","ProductVersion":"1,5026,1000,127","Copyright":"版权所有 (C) 2010-2026","MachineType":"I386","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","_vsnwprintf","IofCompleteRequest","MmGetSystemRoutineAddress","MmIsAddressValid","strstr","IoCreateSymbolicLink","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","RtlInitUnicodeString","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","KeBugCheckEx","RtlRandomEx","KeQuerySystemTime","KeQueryInterruptTime","KeInitializeEvent","RtlCompareMemory","RtlIsNtDdiVersionAvailable","memset","RtlCopyUnicodeString","memcpy","ExFreePoolWithTag","SeCaptureSecurityDescriptor","ExAllocatePoolWithTag","KeGetCurrentIrql","ExReleaseFastMutex","KeQueryPerformanceCounter","KfAcquireSpinLock","KfReleaseSpinLock","ExAcquireFastMutex","WdfVersionBind","WdfVersionUnbind","WdfVersionBindClass","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-11-13 19:59:40","ValidTo":"2026-11-10 19:59:40","Signature":"7027f4dae4e1916c6c1497dc353dcefdef09044faf0b41df8e9cbf316e9efe85e7d6e013218e8a26fcc429326b9ba45d793be971f810a2d94ac47082bb5746f6791d6852fd1a86680337b65509dfe78631e8f603aef366e2f07716d0c65ed188ca0c748c44979be74293858208351ceb59cae059dc2acaa6050db2822f86570b750dcd892f5972680f4a46d1152c2f7e345bcf3a2dd14cc5aea9099e00d3b8be5b07949ccb72d8b7484b24764e7c29704b1001a7b837daa21c76d690e1cfa99ff7324d2f11fe30cf83b79eaac30a776e64c20831fcc1256199ac86d2cb0e8e39f85a1330f8fbfe4fad14d98323ef9d9f3a452badb2e17326e920d235541e7a1f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d98977d115c14597f0bbce9e377d9d36","SHA1":"3c5bed71f114313ca3ffbe905002568e47a13138","SHA256":"642865a6fb047124c66954823d2726901f6288c2a3a1c9062faad0bdb24f738c","SHA384":"65b73fb035c9d2c72325c92641b097a7cf3c34bbdf43137d18a136988635b7c391e46a68bdae71cbfa0688abb80cd0be"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]}]}