Silver Fox Uses a Signed Driver to Kill Security Products
Summary
Analysis of a Silver Fox campaign found fake installers dropping a signed kernel driver that terminates targeted security processes. The report details the driver-loading and termination mechanisms, detection guidance, and containment considerations.
Key points
- Fake installers for applications including WinRAR and Telegram drop NVIDIA.exe, which embeds and loads the NSecKrnl driver.
- The dropper writes the driver to a temporary directory, registers it as a kernel-driver service under a random name, and loads it using NtLoadDriver.
- NVIDIA.exe repeatedly enumerates processes and sends matching PIDs to the driver using IOCTL 0x2248E0.
- The driver uses PsLookupProcessByProcessId, ObOpenObjectByPointer, and ZwTerminateProcess to terminate processes, including names associated with Chinese security products.
- The driver was signed by Shandong Anzai Information Technology CO., Ltd.; the report says one VirusTotal vendor classified it as malicious.
- The report recommends enabling the Windows Vulnerable Driver Blocklist and monitoring driver loads and service ImagePath entries pointing to user-writable temporary paths.
- Removing the driver file and service key may not unload an active driver; the report recommends rebooting after containment and validating that the device is no longer accessible.
Article Details
- Attack Vectors
- Fake application installers, including installers masquerading as WinRAR and Telegram, drop NVIDIA.exe and an embedded driver.
- NVIDIA.exe writes the driver to a user-writable temporary directory, registers it as a kernel-driver service, enables SeLoadDriverPrivilege, and loads it with NtLoadDriver.
- NVIDIA.exe repeatedly enumerates processes and sends matching security-product PIDs to the driver using DeviceIoControl with IOCTL 0x2248E0; the driver terminates those processes.
- Defensive Notes
- Enable the Windows Vulnerable Driver Blocklist and use WDAC/HVCI where feasible.
- Monitor for driver and service installation involving non-default, user-writable paths, and correlate driver-file creation with writes to Services\<name>\ImagePath and subsequent driver loads.
- Use Windows System event 7045 and Sysmon events 6, 11, and 13 to investigate service installation, driver loads, file creation, and registry writes involving temporary paths.
- After containment, reboot and verify that \\.\NSecKrnl is no longer accessible; deleting the service key and driver file alone does not remove a currently loaded driver.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 5d38c8a2e1786e464a368465d594d2b4 | MD5 hash identified for the NVIDIA.exe dropper. |
| MD5 | 80961850786d6531f075b8a6f9a756ad | MD5 hash identified for the dropped NSecKrnl64.sys driver. |
| SHA1 | b0b912a3fd1c05d72080848ec4c92880004021a1 | SHA-1 hash identified for the dropped NSecKrnl64.sys driver. |
| SHA1 | b5a605440f50e8d0fd5b26d01886a3b4a3dd3c8d | SHA-1 hash identified for the NVIDIA.exe dropper. |
| SHA256 | 206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 | SHA-256 hash identified for the dropped NSecKrnl64.sys driver. |
| SHA256 | b4ac2e473c5d6c5e1b8430a87ef4f33b53b9ba0f585d3173365e437de4c816b2 | SHA-256 hash identified for the NVIDIA.exe dropper. |
MITRE ATT&CK
T1057 · Process DiscoveryNVIDIA.exe enumerates active processes with Toolhelp32Snapshot to find names on its targeted security-product list.T1543.003 · Windows ServiceThe dropper creates a service registry key for the driver, sets its ImagePath and kernel-driver type, and loads it with NtLoadDriver.T1562.001 · Disable or Modify ToolsThe malware uses the driver and IOCTL 0x2248E0 to repeatedly terminate targeted security-product processes.
Threat Actors
Products
360 AntivirusThe list comprises Chinese security products, strongly suggesting targeting of Chinese victims, with a focus on 360 Antivirus (Beijing Qihoo Technology Co., Ltd.).TelegramDuring threat-intelligence activities, we identified a new Silver Fox campaign distributing fake application installers (e.g., WinRAR, Telegram, and others).WinRARDuring threat-intelligence activities, we identified a new Silver Fox campaign distributing fake application installers (e.g., WinRAR, Telegram, and others).