TextSearch

We investigate mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware.

There have already been reports on code-signed rootkits like Netfilter, FiveSys, and Fire Chili. These rootkits are usually signed with stolen certificates or are falsely validated. However, when a legitimate driver is used as a rootkit, that’s a different story. Such is the case of mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware. Security teams and defenders should note that mhyprot2.sys can be integrated into any malware. What we found During the last week of July 2022, a ransomware infection was triggered in a user environment that had endpoint protection properly configured. Analyzing the sequence, we found that a code-signed driver called “mhyprot2.sys”, which provides the anti-cheat functions for Genshin Impact as a device driver, was being abused to bypass privileges. As a result, commands from kernel mode killed the endpoint protection processes. As of this writing, the code signing for mhyprot2.sys is still valid. Genshin Impact does not need to be installed on a victim’s device for this to work; the use of this driver is independent of the game. This ransomware was simply the first instance of malicious activity we noted. The threat actor aimed to deploy ransomware within the victim’s device and then spread the infection. Since mhyprot2.sys can be integrated into any malware, we are continuing investigations to determine the scope of the driver. Organizations and security teams should be careful because of several factors: the ease of obtaining the mhyprot2.sys module, the versatility of the driver in terms of bypassing privileges, and the existence of well-made proofs of concept (PoCs). All these factors mean that the usage of this driver is likely higher than those of previously discovered rootkits (such as the ones mentioned in the preceding section). Meanwhile, the timeline and attack sequence of the threat actor’s activities that we present here are noteworthy for security teams. A list of the techniques used in this operation can be found in the MITRE ATT&CK analysis at the end of this article. Timeline of activities Figure 1. Attack overview The earliest evidence of compromise was a secretsdump from an unidentified endpoint of the targeted organization to one of the domain controllers. It was followed by the execution of discovery commands using wmiexec in the context of the built-in domain administrator account. Both secretsdump — which dumps secrets from the remote machine without executing any agent there — and wmiexec — which executes commands remotely through Windows Management Instrumentation (WMI) — are tools from Impacket, a free collection of Python classes for working with network protocols. Figure 2. Early evidence of compromise Shortly afterward, the threat actor connected to the domain controller via RDP using another compromised administrator account. From there, everything was executed in the context of that user account. Figure 3. The threat actor connecting to the domain controller via RDP Note: The process rdpclip.exe running under the context of the compromised administrator account was the only destination system artifact supporting the use of RDP toward the domain controller. It facilitates clipboard sharing between RDP sessions. A malicious file, kill_svc.exe (C:\users\{compromised user}\kill_svc.exe), and mhyprot2.sys (C:\users\{compromised user}\mhyprot2.sys) were transferred to the desktop. This was the first time that the vulnerable driver was seen. The file kill_svc.exe installed the mhyprot2 service and killed antivirus services. Figure 4. The suspicious kill_svc.exe file executed Figure 5. The vulnerable device installed Another malicious file, avg.msi, was transferred to the netlogon share \\{domaincontroller}\NETLOGON\avg.msi. This Windows installer contains avg.exe, a malicious file masquerading as AVG Internet Security, and is responsible for dropping and executing the following: logon.bat – A batch file that executes HelpPane.exe, kills antivirus and other services, and executes svchost.exe. HelpPane.exe – A malicious file masquerading as Microsoft Help and Support executable; similar to kill_svc.exe, it installs mhyprot2.sys and kills antivirus services. mhyprot2.sys – A vulnerable Genshin Impact anti-cheat driver. svchost.exe – The ransomware payload. This also shows that the threat actor intended to mass-deploy the ransomware using the domain controller via startup/logon script. The Windows installer avg.msi hosted on the netlogon share was deployed to one workstation endpoint via Group Policy Object (GPO). We suspect that this was to test whether deployment via GPO would be successful, but this case resulted in a failure. Figure 6. The Windows installer avg.msi deployed via GPO Afterward, the threat actor logged in to the workstation from the unidentified endpoint. Both Logon Typ...

Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus