← Back to driver explorer
Driver intelligenceVulnerableVerified
TPwSav.sys
A driver associated with Toshiba laptops power saving functionality allows arbitary one byte reading and writing mapped physical addresses. Blackpoint Cyber's SOC observed this driver being used as part of a custom EDRSandblast malware to blind EDR prior to Qilin ransomware deployment.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
TPwSav.sysSample 1 · HVCI unknown
- MD5
b0caa4f3ac2841be683933a6af9bee0e- SHA1
c1130e09831c7a2e0cc8ba7335e702910b25f526- SHA256
011df46e94218cbb2f0b8da13ab3cec397246fdc63436e58b1bf597550a647f6- Imphash
7ac4904ded1efd522ece72259cf28a46- Authentihash MD5
e3745d926e84b626dfd36eea8b4211bc- Authentihash SHA1
8057487b702996c56d4cbb96a0c63a6ed82271b5- Authentihash SHA256
8e9f3f58005d62b241874e9790d457d0fbffc101062166f70a5c27aceefdde36- Machine
- AMD64
- Version
- 2, 0, 0, 2
- Publisher
- Compal Electronic, Inc.
Recorded command
sc.exe create TPwSav.sys binPath=C:\windows\temp\TPwSav.sys type=kernel && sc.exe start TPwSav.sysElevate privileges, Blind EDR · Privileges: kernel · OS: Windows