{"Id":"3207f14b-a66c-4d5e-a5d5-2467ffd58265","Tags":["d39DuiY9sxtDSiu4LSvS.sys","wifis.sys"],"Verified":"TRUE","Author":"wwwab","Created":"2026-08-29","MitreID":"T1547.006","Category":"malicious","Commands":{"Command":"sc.exe create wifis binPath= C:\\windows\\temp\\d39DuiY9sxtDSiu4LSvS.sys type= kernel && sc.exe start wifis","Description":"This purpose-built kernel loader creates the \\\\.\\wifis device and accepts encrypted PE images through IOCTL 0x222000. Its worker thread decrypts input with an RC4-like routine using the embedded key dsmjklsafbv, manually maps the supplied PE image, resolves imports and relocations, and transfers execution to the unsigned payload in kernel memory.","Usecase":"Reflectively load and execute an unsigned kernel payload after the loader is installed.","Privileges":"Administrator","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/400"],"Detection":[],"Acknowledgement":{"Person":"wwwab","Handle":"@wwwab123"},"KnownVulnerableSamples":[{"Filename":"d39DuiY9sxtDSiu4LSvS.sys","MD5":"8e82dfac112073fce1697dbca586b5b9","SHA1":"5fdc38f30fefcdad652a761927fa5d4fa9ff1122","SHA256":"00833dd6f61e768ec3cfdf2bdc5ef074df07f2df8921558e4c5e5a32e97b4080","Imphash":"5445ae5cd933e77e5ece380db932320e","Authentihash":{"MD5":"8e692d8ebcedf22274fe23c053c642d3","SHA1":"98af0d0f259c2d35dedc2f87aded8ba3e6b66a7a","SHA256":"9360e91c4183f3215254698bf804ed242957451f06a31b0a2b1c8a7f05035f80"},"RichPEHeaderHash":{"MD5":"1fd5836e392383ade7b29361a8698502","SHA1":"cbee2da2b5e56e35277319f55d812269728e0b9e","SHA256":"25aa3b0bcbb905632a8e526e07735e7ca0360aa027e0c37bea8bb3934b12f8f5"},"Sections":{".text":{"Entropy":6.352496592156005,"Virtual Size":"0x10e8"},".rdata":{"Entropy":5.002501678389281,"Virtual Size":"0x614"},".data":{"Entropy":3.1174924611847556,"Virtual Size":"0x18"},".pdata":{"Entropy":3.6415360036048567,"Virtual Size":"0xd8"},"INIT":{"Entropy":5.252843306478683,"Virtual Size":"0x2fe"},".reloc":{"Entropy":2.6464393446710157,"Virtual Size":"0x14"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-11-10 03:26:04","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","DbgPrintEx","ExAllocatePool","ExFreePoolWithTag","PsCreateSystemThread","PsTerminateSystemThread","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","KeStackAttachProcess","KeUnstackDetachProcess","ZwWaitForSingleObject","PsInitialSystemProcess","strstr","_strupr","MmGetSystemRoutineAddress","ZwQuerySystemInformation"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-02-20 20:08:08","ValidTo":"2026-02-18 20:08:08","Signature":"3a915ff496468e86d34a86bc4951e3d12d88d33fdd9826b98e674328eb433cad2113c9b57ceef54448eff7b018068dd2dcdab1daadf0536e5840a50e8adfd9da55a6094444c2b2222c402518668f8b610fde25de085d0097ff8e1548d3f15214de67bc40ec593546a1d2996ac74a9667ad8a05872c13ea1f68febffa660d691ff628a2240586db6fb6e26c5df277774231f7cb85e07d2c9918693e23e31b55b10dcb8fc7a1c588aa9089a96f4cd119fa76a370a9abcf4d43a2ceefb1c8adfbd13c76ccecc99c11f6bb8a56f4ea2bf19a6183feb46852de6b673c9bdaf830ffa07ac365efaf5184e21e5c3f32b308342fd07f2e3e2eccc753057aa3688984a183","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000124e76f6ca813a27c35000000000124","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"cfe40b64f31750e7a57db8c4ad451bff","SHA1":"4031068d5106d7b364c9b99daf963a00fce3c1fb","SHA256":"11dfc1860474603fc5821f01931eb0e945a652e9e5d48b5042472941109b1932","SHA384":"fafef1d7376886b2895becf586b67dbb317d6ad4398625b0eed2725280d6b29ea072dc4ec32fbc5e041996f8708351f9"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"3300000124e76f6ca813a27c35000000000124","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]}]}