wantd.sys

WAN Transport Driver file version info

Driver on Windows LOLDrivers malicious 1 Sigma rule names it

A known malicious driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/127cde1d-905e-4c67-a2c3-04ea4deaea7d/
https://www.loldrivers.io/drivers/3277cecc-f4b4-4a00-be01-9da83e013bcd/
https://www.loldrivers.io/drivers/72637cb1-5ca2-4ad0-a5df-20da17b231b5/

6 known samples

6.1.7600.1172 · its entry

06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4

6.1.7600.1172 · its entry

8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce

6.1.7600.1172 · its entry

b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3

6.1.7600.1172 · its entry

e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e

6.1.7600.938 · its entry

6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f

5.2.3790.938 · its entry

81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real wantd.sys?

file version info and known copies

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWAN Transport Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names wantd.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.