sxav64-v1.5.1.sys
The signed SXClient sxav.sys security driver processes an SXBOOTDB boot configuration whose integrity is protected only by an unkeyed MD5 digest. Public research demonstrates that an administrator can generate a valid configuration containing arbitrary absolute paths, point the service to it, and have the kernel driver delete those files during the next boot. The primitive can be abused to remove security-product files that are otherwise locked while Windows is running.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
sxav64-v1.5.1.sysSample 1 · HVCI unknown
- MD5
29a53ceac3376e0928a898779adb4c5a- SHA1
77488e805d266aa1968842b4698565bb4fd8c36c- SHA256
4d47e7f1c87d758d9e3f17d0d53634c454ee1785478a8c7de7f3c83ecd3d3896- Imphash
044f125cfa7e2697826082f8d5501ccf- Authentihash MD5
82a5166a8b7710ea462b6b6b686ec5d6- Authentihash SHA1
6f5b769888b5989990478d34d16b120adf50e27c- Authentihash SHA256
9c246d9c611383dc1b32fda185322629aedc8527bd831ebfe41f5f92b1332070- Machine
- AMD64
- Version
- 3.0.0.2
- Publisher
- 河南寒露电子科技有限公司
Recorded command
sc.exe create Sxav binPath= C:\windows\temp\sxav64-v1.5.1.sys type= kernel start= systemDelete protected antivirus or EDR files during system boot using an attacker-generated boot configuration. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: wwwab @wwwab123