mhyprot2.sys – Genshin Impact anti-cheat driver.

HelpPane.exe – disguises itself as the Microsoft Help and Support executable file, similar to kill_svc.exe, as it installs mhyprot2.sys and “kills” anti-virus services.

logon.bat – launches HelpPane.exe, “kills” the antivirus and other services, launches svchost.exe.The attackers then downloaded the avg.msi file, which in turn downloaded and executed the following four files: The first action taken by the hackers on the compromised machine was to transfer mhyprot2.sys to the desktop along with the malicious executable kill_svc.exe that was used to install the driver. Worse, since 2020, two PoC exploits are available on GitHub at once and a detailed description of how you can use anti-cheat from user mode to read/write kernel memory with kernel mode privileges, terminate specific processes, and so on.Ī recent Trend Micro report states that hackers have been abusing the driver since July 2022 and using it to disable properly configured security solutions.Īnalysts write that in the example they studied, the attackers used secretsdump and wmiexec against the target machine, and then connected to the domain controller via RDP using stolen administrator credentials. In the case of mhypro2.sys, the appeals of experts had no effect, the code signing certificate was not revoked, and therefore the program can still be installed on Windows without raising alarm.

The mhypro2.sys problem has been known since at least 2020, and information security experts have long been appealing to manufacturers of anti-cheat systems in general, since most of these solutions work at the ring 0 level, which can hardly be considered safe. Let me remind you that we also wrote that Tencent and Chinese police conducted a joint operation against game cheat developers. Mhypro2.sys gives access to the memory of any process and kernel, and is also able to terminate processes with the highest privileges.

Trend Micro experts have discovered that hackers are abusing the system anti-cheat driver of the popular game Genshin Impact to disable anti-virus software during ransomware attacks.

Trend micro antivirus software