windows verified critical v1.0.0

bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56

hlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution.

📋 Live Preview 
sc.exe create KMHLPSVC binPath=C:\windows\temp\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC
sc.exe create KMHLPSVC binPath=C:\windows\temp\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Detection

TypeRule / Indicator
yara https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create KMHLPSVC binPath=C:\\windows\\temp\\hlpdrv.sys type=kernel && sc.exe start KMHLPSVC"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56"

bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56

hlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References