← Back to driver explorer
Driver intelligenceVulnerableVerified
ZYArKit.sys
V-secure ZYArKit.sys version 2.0.13.5 is a signed kernel driver assessed in public KOSEC BYOVD research. KOSEC documents an IOCTL path that references a user-supplied process handle and reaches ZwTerminateProcess, allowing administrator-context termination of non-protected processes from kernel mode.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
ZYArKit.sysSample 1 · HVCI unknown
- MD5
d751a1ebc49ecd3ce75ef683878057db- SHA1
8887fc3afcdf48721312d8df9865c6c8234b8614- SHA256
46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e- Imphash
5bbe6d6461f110de7875f60c2e2b9511- Authentihash MD5
945f387dcd4b0ecaa664a26a0049816b- Authentihash SHA1
a985c374508122eccdf5b056681763336913458a- Authentihash SHA256
185a44e928571d883a1175945d273b493da07fe4b49c52e88eb336980c855152- Machine
- AMD64
- Version
- 2.0.13.5
- Publisher
- Not recorded
Recorded command
sc.exe create ZYArKit binPath=C:\windows\temp\ZYArKit.sys type=kernel && sc.exe start ZYArKitTerminate non-protected processes from kernel mode through a vulnerable IOCTL path. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KOSEC LLC