← Back to driver explorer
Driver intelligenceVulnerableVerified
hax.sys
Intel Hardware Accelerated Execution Manager versions before 7.7.1 are affected by CVE-2022-21812. The tracked 6.1.0 through 7.7.0 IntelHaxm.sys builds all precede the fixed release. Improper access control on the \Device\GHAX interface allows an authenticated local user to cross the user-to-kernel security boundary and elevate privileges.
Known samples 9
0 recorded TRUE · 0 recorded FALSE · 9 unknown for loading despite HVCI. Results apply to individual samples.
hax.sysSample 1 · HVCI unknown
- MD5
01d673c8b80f4df91147e29e6cecefe5- SHA1
b0c6b13b45613c0bedfd89c411ac605cb30763c3- SHA256
e6d2868eeaaf315c4f022844a2fe55dff7f76445c057b3057024e6fd3365d020- Imphash
ac0e39541ff8c69c346f2bf02d27f914- Authentihash MD5
d65ac45056a33f230fe5002f5b82c4f7- Authentihash SHA1
f6f78a986bba20e3b9c751e913b4e73cbe86bcb0- Authentihash SHA256
584f0375649c970b06dc17715f0058f904e0cbcdb376b74ff2ab3be8d6d3e844- Machine
- AMD64
- Version
- 7.7.0
- Publisher
- Intel Corporation
hax.sysSample 2 · HVCI unknown
- MD5
a0c976d84bc63855293709d3388dde48- SHA1
6e2ca8df65b92a1a9e7eeccf188a8b405b585c7e- SHA256
c5a1957b8fcdcaa1890889f89629c9a9a3ff6b58d01fa7eb061c50c8213bbf97- Imphash
8ccbf11ad45bf762b534778465400648- Authentihash MD5
8d5d617d5af0bd1fd8d8230877416c6a- Authentihash SHA1
e65d6c7b01e79f9aa6f90ef741fd30fce50a256d- Authentihash SHA256
48503feae3f95caa8b1dc6850b37f8409577ffe9e6501231241cba03bc4e1ae0- Machine
- AMD64
- Version
- 7.6.5
- Publisher
- Intel Corporation
hax.sysSample 3 · HVCI unknown
- MD5
0be920b2bfce125b87163809b9936024- SHA1
19f84ee6ead438a91b517c55b6d6a4b282385df9- SHA256
6272aa047c054424f30f09b9ffbc543f4084fa4ac878c7b90d29fbc0502e0e33- Imphash
06ce1597f7226b932637e2d93f454dc4- Authentihash MD5
dd78a122031c586ac9a2e7e6aaad258b- Authentihash SHA1
63c151487830fbf094551f25a20bdedde9293390- Authentihash SHA256
3aa4f0976b805375a7ef265b0148c0994dabfc6d2b7cd9c5cdec33ef70f6151f- Machine
- AMD64
- Version
- 7.6.5.3
- Publisher
- Intel Corporation
IntelHaxm.sysSample 4 · HVCI unknown
- MD5
67707c0139c68f9b508f7455fe963c11- SHA1
bfbaf599547e65a2996acda2d8ea6d3ef8ba11a4- SHA256
7e2e727d71baa430d38988a08b9879bca72cf9fb203dd100e00da2416c87f8b0- Imphash
30427c3c605d02ddc2e82df1caeb82ae- Authentihash MD5
8986ea50cbce797be2173304163a2776- Authentihash SHA1
e5112845e5b80b4d2aa5528edebf7f496b02d474- Authentihash SHA256
7dc421f6a683f5b4193009192b1586661648b031b14d2d7548cb4c85d7c630b7- Machine
- AMD64
- Version
- 7.5.4
- Publisher
- Intel Corporation
IntelHaxm.sysSample 5 · HVCI unknown
- MD5
09bfdf7a7f87af879e98c3000d7048cb- SHA1
7b00980d8849a60f31ab548fbdf8b0f616b33671- SHA256
a17b6c35f161f9333eecfd24577d4bf544e228c239d4ce87b093c7e4a77326bd- Imphash
2c0d2bc53042057628769b19fbd7812f- Authentihash MD5
7361de7738659c05f66a2697daef3e60- Authentihash SHA1
aa2e39720db40f981946aab39f48da7318dea9e1- Authentihash SHA256
5983d13ccedf9d4387338adbeca6ea6f28db3adaa7c95520b13a83672847801e- Machine
- AMD64
- Version
- 6.1.0 built by: WinDDK
- Publisher
- Intel Corporation
IntelHaxm.sysSample 6 · HVCI unknown
- MD5
20afdbd8c895807a95ac17ad70a7d1a1- SHA1
0bc78891caa74386a8827e03e6933361c0842038- SHA256
b1b502bfac0509b3c08df2e09ad5b3c6f508a3abf7b85eb025d9b961151d8cb2- Imphash
7b35ba0eab755d6841eddf3efa718087- Authentihash MD5
9cae0a5c1f8287e9ba601898ff60eac8- Authentihash SHA1
7a25948a02d1bdd95b1622a3b946686c9d270f1e- Authentihash SHA256
efd475a4bb291c3584bdb57a7b5769728a3ba79b60fbba6442b1e46881ad24dd- Machine
- AMD64
- Version
- 7.5.1
- Publisher
- Intel Corporation
IntelHaxm.sysSample 7 · HVCI unknown
- MD5
e62d7455629aa7b10e4b5061d375b5d9- SHA1
fa6513a11948aae608d56ffe0a55aaf7469f01a0- SHA256
b68e8cd643e9d28bade6867563939de0638cbb3b6e6bbff5933449eacbcb68d9- Imphash
538de36a0b5111f2d0ce19dd2ce8bcb5- Authentihash MD5
c9071e85968911a2b7c299c617877278- Authentihash SHA1
8d4d9e2a33f41a918fbad3b52e5c06de593389ce- Authentihash SHA256
d533f5690055901f1c59b5152abfcedbbd0b0d1209e57b3cf6d0dca23e64b718- Machine
- AMD64
- Version
- 7.3.2
- Publisher
- Intel Corporation
IntelHaxm.sysSample 8 · HVCI unknown
- MD5
908af5100aec581ca91a98ca516f6ded- SHA1
ae15918d8bded194f418b7d11abb77cb9a605e95- SHA256
d91272678e1adedef58c9f258e032e84c0a2d4e7a101636de6931836add73321- Imphash
7b35ba0eab755d6841eddf3efa718087- Authentihash MD5
655e836a1d87e819cdcb4e252dd57347- Authentihash SHA1
01625b9a58a277f41ab977d2684958095b268a63- Authentihash SHA256
5e39ac13f9fadb4eb6f0e4d44f9685b2d067f6889e35fe9e8ed9d6b8bff52db6- Machine
- AMD64
- Version
- 7.4.1
- Publisher
- Intel Corporation
IntelHaxm.sysSample 9 · HVCI unknown
- MD5
668e445ce229e319623e32515fa4c6e9- SHA1
e2700776d95466e416fd4237c467c33a3d8b44a3- SHA256
df22e797390c7cc401eade8e06d2961aa402801acaaca704ddef7b6c1d457166- Imphash
7b35ba0eab755d6841eddf3efa718087- Authentihash MD5
7faa61e9d228abe1d7bcb5678189c93d- Authentihash SHA1
3eb9c06d6a3f6918982e2a4fa072a4c85bc73588- Authentihash SHA256
964cd4d1cb9a2aafb320d44da14194e406b446338ce097ef798d8bf9884cee81- Machine
- AMD64
- Version
- 7.5.2
- Publisher
- Intel Corporation
Recorded command
sc.exe create IntelHAXM type= kernel binPath= C:\\windows\\temp\\hax.sys && sc.exe start IntelHAXMElevate privileges · Privileges: User · OS: Windows
Research & references
Acknowledgement: fluffycats31 @fluffycats31