# How a Tax Search Leads to Kernel-Mode AV/EDR Kill

Malvertising campaign delivers rogue ScreenConnect, then a crypter dropping a signed Huawei audio driver abused as BYOVD to kill AV/EDR from kernel mode.

- Payout: Real-world hack
- Severity: high
- Program: Huawei HWAuidoOs2Ec.sys
- Analysis by: Huntress
- Disclosed: 2026-03-19
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-w2-malvertising-to-kernel-mode-edr-kill
- Tags: area:os domain:desktop impact:data-leak impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:reverse-engineering vuln:misconfiguration vuln:privilege-escalation

**Target:** Signed Huawei kernel audio driver (HWAuidoOs2Ec.sys) exposing process-termination IOCTL
**Root cause:** The signed Huawei driver's IOCTL dispatch handler accepts a 4-byte PID, copies it via memcpy_s, and passes it to ZwOpenProcess with PROCESS_ALL_ACCESS then ZwTerminateProcess with no validation of the target process.
**Steps:**
1. Victim clicks Google Ad for 'W2 tax form' landing on anukitax[.]com/forminw9/ redirecting to bringetax[.]com/humu/
2. Cloaking layers (JustCloakIt server-side, Adspect client-side fingerprinting) serve payload only to real victims
3. Rogue ScreenConnect installer form_w9.msi establishes trial relay instance-itsd8c-relay.screenconnect[.]com with y=Guest
4. Attacker runs C:\Windows\SystemTemp\ScreenConnect\25.9.5.9473\crypteds.exe (FatMalloc crypter)
5. FatMalloc allocates 2GB, decrypts shellcode, executes via timeSetEvent callback
6. Shellcode XOR-decrypts CHOC config, RtlDecompressBuffer format 0x102 (LZNT1) to load HwAudKiller PE in memory
7. HwAudKiller decrypts embedded Havoc.sys with rolling key `41 73 61 40 41 31 61 40`, writes to %TEMP%\Havoc.sys, runs `sc create Havoc binPath= <path> type= kernel start= demand` then `sc start Havoc`
8. Loop enumerates processes and sends matching PIDs via DeviceIoControl IOCTL `0x2248DC` to `\\.\HWAudioX64`
**How found:** Retrospective threat hunting uncovered 60+ rogue ScreenConnect sessions; an exposed open directory revealed the cloaking setup, fake Chrome update lure, and shared 4sync infrastructure; hunting for additional Havoc driver instances surfaced a second intrusion with an expanded kill list.
**Exploitation:** After EDR processes are killed from kernel mode, attacker pivots to LSASS dumping via `rundll32.exe C:\windows\System32\comsvcs.dll, #+000024 %B \Windows\Temp\<random>.log full`, then NetExec (nxc) with lsassy and --dpapi modules for mass lateral credential harvesting using a compromised admin account.
**Escalation:** Chained malvertising -> cloaked landing -> rogue RMM -> crypter -> BYOVD kernel driver kill -> LSASS dump -> mass lateral credential harvesting, consistent with pre-ransomware/IAB playbook.
**Insight:** Signed vendor drivers with process-termination IOCTLs that take a raw PID and call ZwOpenProcess/ZwTerminateProcess without validation are prime BYOVD candidates; check LOLDrivers gaps and vendor audio/chipset drivers for unvalidated IOCTL handlers.

## Proof of concept (copied exactly from the original report)

**LSASS dump via comsvcs.dll rundll32 command**

```
cMd.ExE /Q /c for /f "tokens=1,2 delims= " %A in ('"tasklist
   /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe
   C:\windows\System32\comsvcs.dll, #+000024 %B \Windows\Temp\
   <random>.log full
```

**HwAudKiller loads Havoc.sys kernel service**

```
writes it to %TEMP%\Havoc.sys, and loads it as a kernel service via sc create Havoc binPath= <path> type= kernel start= demand followed by sc start Havoc.
```

**Kill IOCTL 0x2248DC sent to driver**

```
For each match, it sends the target PID to the kernel driver via DeviceIoControl with IOCTL code 0x2248DC.
```