{"DetectionScope":"context-only","ResearchEvidence":{"Id":"00561455-9da1-4f0c-8564-e4c99b716a74","Tags":["driver_090d409f.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2024-09-10","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create driver_c3d48ddd.sys binPath=C:\\windows\\temp\\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sys","Description":"Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"","MD5":"41046ce853788277da0d7e8c4e0a3123","SHA1":"e9bca8f4b8c60688eacc7d18c6ba7777c181bb84","SHA256":"090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49","Signature":"","Date":"","Publisher":"","Company":"Pinchins Technology Co.,Ltd.","Description":"RWTKrl","Product":"RansomwareTerminator","ProductVersion":"1.0","FileVersion":"1.0.0.807","MachineType":"AMD64","OriginalFilename":"RWTKrl.sys","Imphash":"53ae9acf513f6b93672a362615da5fbb","Authentihash":{"MD5":"7ca020674114f5f8aad94c9cc61dccb4","SHA1":"f27d87a335c87654ebbbde16d41645be85f0424a","SHA256":"77cb09dc2fc3c56f3b12ad03a85cedbe3a8e0bb876dadfd76a1fb6c57602817b"},"RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"Sections":{".text":{"Entropy":6.2141911024437135,"Virtual Size":"0xc49a"},".rdata":{"Entropy":3.97789494649911,"Virtual Size":"0x22c4"},".data":{"Entropy":0.5629273005989984,"Virtual Size":"0x2158"},".pdata":{"Entropy":7.530650623586551,"Virtual Size":"0x7c8"},"PAGE":{"Entropy":6.187854492162779,"Virtual Size":"0x1109"},"INIT":{"Entropy":5.884896074292579,"Virtual Size":"0x1a6a"},".rc0":{"Entropy":6.653479611931667,"Virtual Size":"0x1062b0"},".reloc":{"Entropy":5.494242051238899,"Virtual Size":"0x5a8"},".rsrc":{"Entropy":3.302600952040726,"Virtual Size":"0x3e4"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-05-16 04:13:17","InternalName":"RWTKrl.sys","Copyright":"Copyright (C) 2016 Pinchins Technology Co.,Ltd.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoCreateNotificationEvent","ExInitializeNPagedLookasideList","ExAcquireFastMutex","RtlInitUnicodeString","IoDeleteDevice","ExpInterlockedPushEntrySList","MmGetSystemRoutineAddress","KeInitializeEvent","ExpInterlockedPopEntrySList","RtlDeleteElementGenericTable","IoDetachDevice","PsSetCreateProcessNotifyRoutine","RtlEqualUnicodeString","KeDelayExecutionThread","ObQueryNameString","ZwQueryValueKey","_vsnwprintf","ZwClose","ExQueryDepthSList","KeWaitForSingleObject","IoAttachDeviceToDeviceStack","PsGetVersion","RtlCompareUnicodeString","ObfReferenceObject","IoCreateSymbolicLink","ObfDereferenceObject","IoCreateDevice","IoRegisterFsRegistrationChange","RtlIsGenericTableEmpty","IofCallDriver","RtlInitializeGenericTable","ZwOpenKey","ExQueueWorkItem","_wcsnicmp","KeSetPriorityThread","KeSetEvent","wcsncpy","ZwCreateFile","wcsrchr","MmMapLockedPagesSpecifyCache","ExSystemTimeToLocalTime","ExInterlockedInsertTailList","PsTerminateSystemThread","RtlLookupElementGenericTable","IofCompleteRequest","RtlTimeToTimeFields","ExInterlockedRemoveHeadList","PsGetCurrentThreadId","PsGetCurrentProcessId","ZwQueryInformationFile","RtlInsertElementGenericTable","PsProcessType","PsLookupProcessByProcessId","ZwQuerySymbolicLinkObject","ZwReadFile","ExReleaseFastMutex","ZwOpenSymbolicLinkObject","IoVolumeDeviceToDosName","IoFileObjectType","IoDriverObjectType","IoGetDeviceObjectPointer","ExAllocatePool","ObReferenceObjectByHandle","IoCreateFileSpecifyDeviceObjectHint","IoFreeIrp","ZwDeleteFile","IoAllocateIrp","ZwDeviceIoControlFile","IoGetTopLevelIrp","ObReferenceObjectByName","ZwWriteFile","ObReferenceObjectByPointer","ObOpenObjectByPointer","DbgPrint","_stricmp","_wcsicmp","PsGetProcessImageFileName","PsCreateSystemThread","PsGetProcessId","CmRegisterCallback","MmIsAddressValid","RtlVolumeDeviceToDosName","_snwprintf","RtlAppendUnicodeToString","RtlAppendUnicodeStringToString","RtlCopyUnicodeString","ExAcquireResourceExclusiveLite","KeLeaveCriticalRegion","RtlAnsiStringToUnicodeString","RtlInitAnsiString","KeEnterCriticalRegion","ExAcquireResourceSharedLite","ExReleaseResourceLite","ExInitializeResourceLite","ZwDeleteValueKey","MmFlushImageSection","ExIsResourceAcquiredExclusiveLite","CcPurgeCacheSection","CcFlushCache","ZwSetInformationFile","ZwOpenFile","KeBugCheckEx","ExFreePoolWithTag","IoDeleteSymbolicLink","RtlGetElementGenericTable","IoBuildDeviceIoControlRequest","KeClearEvent","swprintf","ExAllocatePoolWithTag","__C_specific_handler","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, O=WoSign CA Limited, CN=WoSign EV Code Signing CA","ValidFrom":"2015-04-18 00:58:58","ValidTo":"2025-04-18 00:58:58","Signature":"26be3926c8bc7f267da8d15f7febe4bb3101707380adcd8c56c0a79ab07905805ac50219087fcdd2698fe902234c3f29ae30e877bfda43093a8f5b3a65e9522786d1e4c751c82dd87dea75521da7d25c28425918d87e6cbff131407de959c498174254303e1c4dbdaa19d410924155506b166ad4e5f64e37238a3a67c03ab559f73f13c143e3b67e8c309e0b25ba226ee84cad577a9a5d30881ba5e5e0b19c34085725a2226ba9a687eaa22611a09fef925acfe986ea328aba3b52c8c46a7e14dd74e056c177bfc018be92ee49d63c3b02c7672cb2f3ddc669638465342d7eeba89219dfd93bb98015c570bae03840801f8cc8fdebf445024b8e9255e251245a1c617cc749687c9f09b8e8befb2d1e8439c6bed52ff5bf60f313f6a90f30dd3799372cb876b6eafb3bfaab9a1cc9d598e5a72d165f2bb577e01076b75bf62df21fabf718c4d0fdb948ab2dcc176350279428ce4a793660a8832d719c2583f684603a3bece107f868c649e81cfd1c1b15d966dee69ed6d8b05ccbf741a7c4fb34ebd87d91a55a06cec7cf11dec3a03ecb9059d3f025bf29203d5a928876aa089c02cfca37062650fb6eec15d28ab89dbdee6200177927524504e213b4e6fec63c6d2f02e12f1daca17758cfd44af9571b49350cfe633452eceb53dcba2674afa484dc3c0a98b315592d9964fcadb9afd296e2e66344e28dfee4d479fc975d2e56","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"2b6bd65459d70cd8e213b1c4113be213","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"1b1b63b6c5bcca2bbe08f6d91d0fb222","SHA1":"99e402e691ee22e237b59c2c95ef07f396393a6b","SHA256":"e3f9ea7f77a3b7349399ae5c40ef533c06c7d6e551949e0c7898d298fb7463cf","SHA384":"8d4c0779c89895a8a595b8823196d10eed2bdc9cc3c462490c51fdf1938778878b64c82f78e36f6f4c6a74b9366fbb11"}},{"Subject":"??=CN, ??=Fujian, ??=Fuzhou, ??=Private Organization, serialNumber=91350105MA347X7Y7X, C=CN, ST=Fujian, L=Fuzhou, postalCode=350015, ??=ZONE A,1240, 15/F, COMPLEX BUILDING, FUZHOU BONDED AREA, O=Pinchins Technology Company Limited, emailAddress=support@pinchins.com, CN=Pinchins Technology Company Limited","ValidFrom":"2016-09-05 03:15:38","ValidTo":"2018-11-05 03:15:38","Signature":"aadcb357f69b98196e7420fc2b8766d399782fb1a043a1480017279de4787277faea0d6ea942ac10cb1cd367f51cf273ceb71e1c6df9210476fea1ddf3b9bea3f1328b5f5492af007c2f94e02c470dfd370edc643a56fafc286c02acb1c08057370641f2a15538db5b9c11fb3f25b6666a0a017aa1626e1052a388cb17957600ff8232f24a57f341571ac39de67a3b4c27514b05277984b3abf2de7b187f25ae42b7a439ee8be0382d0352ad5eaf1ec25c5d1f5644679a6f59ac9502016d026e95cc2348b415a477ad0512c6d50a1fe5d89ff8a132cf87470e21b13b7850acc1b5a594425a33859490232bea5dab93090a845ffd7d8ae89acee976c5a4dac7d1","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"67ec2f35e172353a55ccff3e52540492","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5e1b3f4283ef844866a8ec5ade611af3","SHA1":"db9237e8f298effd7cdd1ca7f804ee2330b0112c","SHA256":"b9bd052aada420cdf0f6f5e50aa80cd8a38d94c7091bea582cbed83d7d5c632a","SHA384":"3239cb107de6796fd1765919f9443a75640e71e12864b6c0879d2a61bf68952a300820eb331592a061b665ee5ad61ff9"}},{"Subject":"C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority","ValidFrom":"2011-04-15 20:13:19","ValidTo":"2021-04-15 20:23:19","Signature":"375933ca5e487d489a5be42fdbdb59a8c61f77c0a58747e86508c6672688d95c58e2c631ac0c32b96f7cc58748db2c0a23484d0dcf1116ef60577ed5326e22de373cc7dc16f3c9ce2939fb37daf5e4e741d8a2f82db3498a601f64ef9c1364b3469a82cc650f18550776c9e9337790a644daefa64d551038316f3a58ed31486190c04615b4c0a64e5493c00db524e55017c6d62392226992e0abab297508255399959f50b65b6753aaa2ba905a6ea3e35b5c830e54426dbdb917a8205284b51a4fb24d68d2c28ff8f9ae837c24a6e6c17f9a932f2e550df87bc1be336fab0cd934585c9c40ce284a015529655d5bfd525a54591171470b3eff2c9ae931d9046a33871d2f880fc99aab14a8c20b4f8589ac25490dff54395513d6b84d6bf44aad1833bc8e0052b476c2eccd8beb60d57880844a0eb93d4d560d1b17176f60fcdbd867cd3d4082b55c567f8d274cc76d5da410b57c410c39912f41d2c6310686eb405087d8131e852f10448b7a0361693b29fedfcdd3e07d19ba3b84e34e9ad78c7cd73d9dd7fd50108f06683bd8be3bbbaa284552eadde83a334caf38c715e3e97cee83eb2a1cbdd8fdf5394e7c5f25b39349ca88e56152f0dd14f8394ead47182aefcc6b29493fd7a48e7abd6f6bee675db7b167a60055014532b842fe96fc06b9cecfcff9fb6eab728718451afce3846a414f36714c77eea3191ab87d098c01","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6139bb9c000000000033","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"5b3304180221a8328ce477b1fd93898f","SHA1":"9b7f1e1653a52d801387f1e51d17fabb8d435d0c","SHA256":"67070bcf2ee304cedd252a1dd8a7222c1be50fd2d5eabef9446cb633e133d264","SHA384":"be36b1ba9a006afb9eb53263634cb8ca38dd6ca7f95ec56f943324f3a26f9c34c2dff1a3a5c72c88513e23e1f20c8824"}},{"Subject":"C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign","ValidFrom":"2006-09-17 22:46:36","ValidTo":"2019-12-31 23:59:59","Signature":"b66df870fbe20d4c98b3074915f504c46ccacaf568a008fe126d9c0406c9ad9a91523e78c45cee9f541deee3f15e30c949e139e0a69d366c57fae6344f55e887a82cdd05f1581291e8cace28788fdf078501a5dc459605d480b22b059acb9aa58be03a67e67347be4afd27b188efe6cacf8d0e269ffa5f5778ad6dfeae9b3508b1c3bac1004a4b7d14bdf7f1d35518acd03370886dc4097114a62b4f8881e70b0037a9157d7ed701963f2faf7b62ae0a4abf4b392e35108bfe0439e43c3a0c0956403ab5f4c2680cb5f952cdee9df898fc78e758478f1c73586933abffdddf8e24017798193ab06679bce108a30e4fc104b3f301c8ebd3591c35d2931e7065827fdbcffbc8991260c3446f3a804bd7be21aa147a64cbdd3743455b322e45f0d9591f6b18f07ce9553619615fb57df18dbd88e4754b98dd27b0e484442a6184570582111faa3558f3200eaf59effa5572720d26d09b5349acce372e6561fff6ec1beaf6f1a6d3d1b57bbe35f422c1bc8d01bd685e830d2fecd6da630c27d1543ee4a8d3ce4b32b89194fffb5b492d7518a8ba719a3baed9c0a94f8791ed8b7b6b20988939834f80c469cc17c9c84ebee4a9a5817670060432cd8365f4bc7d3e13bcd2e86f63aab53bda8d863282789dd9ccffbf576474ed283d446215614bf794b00d2a671cf0cb9ba592bff8415ac13d60ed9fbbb86d9bcea96a163f7eea06f1","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"19c28530e93b36","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"dd50ed7562bd4ce20df7b5c24d9f1446","SHA1":"188ce565932b1320e89f1c94e1b21eb49f714a6b","SHA256":"e9c8df2dbd3edd63c701a9a6b71cf740eb8d54526dba56970712888237086691","SHA384":"3c0a92298ab549c53c98518786164baadde65fa06a197de4784bf34053752ce84ba6b943ae4dcc9944bb334c9e346c91"}}],"Signer":[{"SerialNumber":"67ec2f35e172353a55ccff3e52540492","Issuer":"C=CN, O=WoSign CA Limited, CN=WoSign EV Code Signing CA","Version":1}]}],"LoadsDespiteHVCI":"TRUE"}]}}