KKYUM.sys
The driver creates a device object named "\\.\KKYUM" without strict access controls, allowing low-privileged users to interact with it. It exposes unauthenticated IOCTL control codes "0x22265C" (Read) and "0x222658" (Write) that encapsulate the MmCopyVirtualMemory kernel API. The handler accepts a target Process ID (PID) and a structured array of source/destination virtual addresses directly from user space without checking execution privileges, enabling local attackers to perform unauthorized arbitrary process memory reads and writes against any active process.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
KKYUM.sysSample 1 · HVCI unknown
- MD5
8516410b49bb79c08c19a37c516dad72- SHA1
4d0708b4a6adee830c30b72add84172fb62fd049- SHA256
72bd55f4459c992b9caa1a33cb6862f1f3085ca35839c58dee8b75db22ca605f- Imphash
1f0b3ed19bdad1a668d8bdf3ebeccbab- Authentihash MD5
d4adce0a36ed4692f11bab7f7ac56b3d- Authentihash SHA1
a3398305ceb9e9ce3baf6f7a6690c6c5b38dfc8c- Authentihash SHA256
eed8f67bfdcc3c30362ab35f7f9cf9f21a47065ea03cffcab27ca9d6317a3016- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create KKYUM binPath=C:\windows\temp\KKYUM.sys type=kernel && sc.exe start KKYUMRead and write the virtual memory space of arbitrary processes from kernel mode, allowing attackers to dump sensitive credentials (e.g., from lsass.exe) or elevate privileges. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Element2023H