{"Id":"fd6c52b1-aeaa-4d89-8051-91acc68c3270","Author":"Michael Haag","Created":"2025-03-26","MitreID":"T1068","Category":"vulnerable driver","Verified":"TRUE","Commands":{"Command":"sc.exe create ACPIx86.sys binPath=C:\\windows\\temp\\ACPIx86.sys type=kernel && sc.exe start ACPIx86.sys","Description":"ABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://www.elastic.co/security-labs/abyssworker"],"Acknowledgement":{"Person":"","Handle":""},"Detection":[],"KnownVulnerableSamples":[{"Filename":"","MD5":"608f9ef01086e9a8bdb373925a878c3a","SHA1":"3bb535e63c8cf3fe20b188a01062e72d19dabb63","SHA256":"c5400ae731464079590aad494bcf2e0799bb4281ea49baa9580ab2f1ee207861","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Imphash":"f5060a845b9d8912eae9b7ced7ee5702","Authentihash":{"MD5":"49daabdd1e36adf02bc0918c343a66b9","SHA1":"f739c683b0a20b280ea48e44f6754a1744d1c5ee","SHA256":"cba6ac0031f6ee2ea4bf8ffc7a1cffff7c4448431584f54b9a0fbec799e2466f"},"RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"Sections":{".text":{"Entropy":7.135563486720843,"Virtual Size":"0x21b2"},".rdata":{"Entropy":5.601303936528674,"Virtual Size":"0xac8"},".data":{"Entropy":0.7637264701652552,"Virtual Size":"0x388"},".pdata":{"Entropy":7.2079481224694435,"Virtual Size":"0x1b0"},"INIT":{"Entropy":4.923073636195894,"Virtual Size":"0x578"},".^.@":{"Entropy":7.169016329345333,"Virtual Size":"0x396b64"},".reloc":{"Entropy":3.9645621715769406,"Virtual Size":"0x118"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-02-23 01:10:27","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["CmRegisterCallbackEx","CmCallbackGetKeyObjectIDEx","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoRegisterShutdownNotification","ObfDereferenceObject","ZwClose","ZwOpenKey","ZwEnumerateKey","ZwQueryValueKey","RtlPrefixUnicodeString","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","CmUnRegisterCallback","KeAttachProcess","KeDetachProcess","PsLookupProcessByProcessId","ObOpenObjectByPointer","_vsnwprintf","PsProcessType","RtlGetVersion","ExInitializePushLock","ExAcquirePushLockExclusiveEx","ExReleasePushLockExclusiveEx","__C_specific_handler","_local_unwind","ExFreePoolWithTag","RtlCopyUnicodeString","DbgPrintEx","RtlEqualUnicodeString","RtlInitUnicodeString","wcsstr","ZwTerminateProcess","wcsncmp","WdfVersionUnbind","WdfLdrQueryInterface","WdfVersionBind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Guangdong, L=Shenzhen, O=Shenzhen yundian Technology Co., Ltd, CN=Shenzhen yundian Technology Co., Ltd","ValidFrom":"2013-05-20 00:00:00","ValidTo":"2014-05-20 23:59:59","Signature":"1bae8106004f1ac2702bdcc897bf58debba45fca9d2c72082a3b54ef4a9df3dcbcd1468b1b588d975274ce37c3cbef125a8e334b1c6111e3ffc94eaf9c123b933c93352677f50c077cb8c771b94b21ef4fa882925a14fc580773ed66b54d49f668498e89047687bcc821385abf6ff579af7ab7dc45c60f270476e82fda4176ba85e9a29aa6f747aff19bd13ea0bc850d883e9681e53c5d5f97cb43af98514271b5a90efe591c7ea52aafa4a902fff0904690cd974625557e170b02aa4724010c4b614995ffa54687584f0a09f47e777931c0f132a3836ef31c55310bde34b10bf3cc5a7a546e2432c18645edbf018da59f8be29d4d334be3b78daa6dd35abc70","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"4efa7e7bba65ec1ab774f2b31357d599","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"f830820e8290f2defa077743ca6e7357","SHA1":"0b11022d5c65f12b15ea49da29c45a3bd51ff17b","SHA256":"c3bf6618b96463285ef2dabd06f631513585742cd9f2be85513f4d3763710211","SHA384":"c6079686cb82480e766a96ebe62d3a61fbf6e7dbbfb79248c0ac191dfe30b2e0017868a50f03a73caef4b8f730f6e014"}},{"Subject":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"56fe535ce1c79ebca7ed7e536d6a144b518c405e805faaa4e82fef38c804c9ca3ecfdf3a584eb0d4b663c52957fa02059a454d68db2a1bd4343d9f00c35acb9549a56ee1b0c5fc414d414a6fd377c8d7388de419de18f31f1565836d450c53f90a9a2ea55dbf6f32811892196a5500ad631c52067e55d92968ae4a7c189a79886b2323d827382a298776cafbc7b662231fed7a564cdd9c325bf53d0c4618953b2a2368836441d9006d0f1924156872bdc571676eac4cdb90eb51a51a6207d0be6a00473c722fec4f613e7385ce5a0ab7bac01c1375e3223928dd6d1d09469d4fbae8408191c6a4ce94721b01cf2a6e15679589ae7db7b7cdf90a3d75b66b3c25","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47974d7873a5bcab0d2fb370192fce5e","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e3a93dc2a8a8a668fdbb286bfe9afab5","SHA1":"95795d2aa2a554a423bc8c6e5b0a016d14887d35","SHA256":"d8844186775bddbccaf3dc017064df7d760fd4b85c5d07561a3efd7da950f89e","SHA384":"78d972495720b43a6470b18ae1226bcca20707628087717a9364c14ca053ba264e6d149718b103542d9942200138a69d"}},{"Subject":"C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. , For authorized use only, CN=thawte Primary Root CA","ValidFrom":"2011-02-22 19:31:57","ValidTo":"2021-02-22 19:41:57","Signature":"2dcc71b5e8ba94ff5ee64467007b6afc412c3ee70e41855ab12a932ba95b89f2f72b499c8003f297b8e760a80ed7fd5de545467594f4ed1c9de166228b61fb29f2c6a8bdf387c98f7f47e1c058b64a1aa2e7f718606969e083069e26c775c40c0d79da746b52b9fae8ea3359b9bb18dd291a14dfd36a37277a9da0dacffffc22c4faf009ff33e93e17ba1cc742cfce2743d30c0c5581303db96060ce02ece19ee81ddc852ce0a18d966d95ac17a4713ea16741b6281d2ce3b615e5b7e5a2f6256d86e320acf9f8314f8e629b9833376d6af735523e90feb03b5fc5b852a9e06ea0479a279e97aea24a9e531939ec357ec659de3ae0aaf533f06abda0821812dea18c4570ca2bd62e959145995a5c240049bd23b30ceca43df5b9e1d1b1825a38eea3fba1ab483a8c5dffa065223fd3d3fe4990db1446a3852e8a554b09ab38b2ab63a008d1fdad48e273d812bcc26ca516fad09ac05e38383a2b718e553aac42197a1f0d4220e7ab5d8c6880524ca1c0d488d02321fb901309007b4937afa9df486022abf4f6c2363bf8513c34bbc586e43ae19f4b90fe5461024b159c34176aa94b8d4cb69d2326c83af1d6b805cdda1d6240183a2f1b41cd3a993a0aa9d1d77eb8c4aff7b8c980105ed55df6ce7a9a02c50f6381efb564e9fc5bd8d2619a68c37cf9c78df91e87d5fa2cf816ae9dab068fc86dc741cda14e84e3dac26ebcfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611fb0a400000000001d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a3f222107d4e1085e73b5b589c2f480b","SHA1":"b94aa26cd77c48d91a53ac44506cbd255e1d362c","SHA256":"a39ed0d6fd4eb1a6f7fed60f726e23eae668b7591bc004644625d22c701213fa","SHA384":"64b7643e4146016cbf83c911eb67e4601b6bb8d66f8ee8dcee67b815f91770d86ab23678b984430f22a963e5484881b7"}}],"Signer":[{"SerialNumber":"4efa7e7bba65ec1ab774f2b31357d599","Issuer":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","Version":1}]}]}],"Tags":["ACPIx86.sys"]}