← Back to driver explorer
Driver intelligenceVulnerableVerified
HWAuidoOs2Ec.sys
Huawei HWAuidoOs2Ec.sys is a vulnerable kernel driver from public vulnerable-driver research. Public DragonForce reporting also lists this driver in BYOVD tradecraft used to disable endpoint security tooling. Beazley Security also reported this driver family in an INC ransomware affiliate intrusion; the report does not identify the exact sample hash for this family.
Known samples 2
1 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
HWAuidoOs2Ec.sysSample 1 · HVCI TRUE
- MD5
79003b510f38ce1ab64e4bfb5e202ba4- SHA1
ed20f6f55560b34164d010cf32ce6f29dba2a27d- SHA256
90d2e9e994ed8e964845a26dce741ad43b29ff54cf5faa67271d62d4e24acbc8- Imphash
9cfa9662095195fc2607e952710e62ae- Authentihash MD5
ae7aa5584b9f8044b12e3d1627e50a7c- Authentihash SHA1
5d3b7d7adb28270f9ae7f7b97342cc4a0929e8f2- Authentihash SHA256
0539116b397996d77f961309cefae95af4af97fb8b5113acf4459c417cf39668- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Huawei Device Co., Ltd.
havoc.sysSample 2 · HVCI unknown
- MD5
eef8a950952696b018aa9c6da2f5d7ad- SHA1
1fa071303fb846308571e64727501fb98b1c2be6- SHA256
5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db- Imphash
543809105fd767866c03705a39fb25a8- Authentihash MD5
1e4bd23e6cd64176a5602600c92398b6- Authentihash SHA1
129a114d49191b7b8663f3e84af8848458fe1e8a- Authentihash SHA256
097e26ab94ce6ac36fe5713e0120c805edb048e30bcfa317fd7025f50b761e92- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Huawei Device Co., Ltd.
Recorded command
sc.exe create HWAuidoOs2Ec binPath=C:\windows\temp\HWAuidoOs2Ec.sys type=kernel && sc.exe start HWAuidoOs2EcElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://labs.beazley.security/articles/an-inc-ransomware-affiliates-byovd-buffet
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor
- https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill
- https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/
- https://github.com/magicsword-io/LOLDrivers/issues/377
Acknowledgement: @rainbowdynamix, @DbgPrint