HW.sys
HW - Windows NT-8 (32/64 bit) kernel mode driver for PC ports/memory/PCI access file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/5076e737-6744-4266-bef7-bceda65050d6/
https://www.loldrivers.io/drivers/5969b6dc-b136-480e-a527-3cb2ea2f0da9/
5 known samples
5.0.2.0 · its entry
0483b32f9544e9c3cc3f206e7bc983ea83f5a9ca44864f2af9b8fc10ff45949f4.9.8.0 · its entry
4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a84.9.8.0 · its entry
55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa4.8.2.0 · its entry
6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e54.8.2.0 · its entry
fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2cFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real HW.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names HW.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.