{"Id":"647f72e7-f378-4908-946c-5e45fab448e8","Tags":["driver_5c308aed.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2024-09-10","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create driver_bfcbc010.sys binPath=C:\\windows\\temp\\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sys","Description":"Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"","MD5":"7b3fcc6007d842c4b3235fe2327f4ab5","SHA1":"e86dd3f83e40682407d499aa9ff6de1da8a2a143","SHA256":"5c308aede12fefb8145c015a97d7844106df5469de97773cba3bd3d772dc7d24","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Imphash":"743ecae1e3cf27ca1ec49e662e4b8e86","Authentihash":{"MD5":"f62a8e4ecdb69735325921ef7aa282ef","SHA1":"9919e34fb9e04d9075a274365b66e52cc16f65e4","SHA256":"3768122b8ab7a518d3717cabdfdd7d9592ec986b3f85d40064fdf99c6f569f6b"},"RichPEHeaderHash":{"MD5":"e7601917977692bb4a8bb577bed37d65","SHA1":"c420b5b204c64c7200997f9ea4e9e9f04d82c42e","SHA256":"762a2db1d8088ce2577bc52080960900708348b58a8784678750179ae25070b7"},"Sections":{".text":{"Entropy":6.441482701524482,"Virtual Size":"0x1fea"},".rdata":{"Entropy":4.715774676262042,"Virtual Size":"0x1090"},".data":{"Entropy":1.0815311650012875,"Virtual Size":"0x570"},".pdata":{"Entropy":4.519043036669138,"Virtual Size":"0x54c"},"PAGE":{"Entropy":6.467250501574084,"Virtual Size":"0x9925"},"INIT":{"Entropy":6.097541679685583,"Virtual Size":"0x1ccc"},".reloc":{"Entropy":2.8464393446710154,"Virtual Size":"0x14"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-02-06 04:11:59","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlUnicodeStringToInteger","RtlInitAnsiString","DbgPrintEx","RtlGetVersion","KeInitializeGuardedMutex","ExAllocatePoolWithTag","ExFreePoolWithTag","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ZwClose","ZwOpenKey","ZwQueryValueKey","RtlInitializeGenericTableAvl","RtlCompareString","PsSetCreateProcessNotifyRoutine","RtlImageNtHeader","IofCompleteRequest","RtlInitUnicodeString","KeDelayExecutionThread","ProbeForRead","IoGetCurrentProcess","ObfDereferenceObject","KeStackAttachProcess","KeUnstackDetachProcess","PsIsThreadTerminating","PsLookupProcessByProcessId","ZwAllocateVirtualMemory","ZwFreeVirtualMemory","PsGetProcessWow64Process","PsIsProtectedProcess","ZwProtectVirtualMemory","RtlImageDirectoryEntryToData","RtlAnsiStringToUnicodeString","RtlCompareUnicodeString","RtlAppendUnicodeToString","RtlFreeUnicodeString","KeWaitForSingleObject","MmMapLockedPagesSpecifyCache","MmAllocatePagesForMdl","MmFreePagesFromMdl","PsCreateSystemThread","PsTerminateSystemThread","PsWrapApcWow64Thread","ObReferenceObjectByHandle","ZwCreateFile","ZwQueryInformationFile","ZwReadFile","PsGetCurrentThreadId","PsGetProcessId","PsLookupThreadByThreadId","ZwWaitForSingleObject","ZwQuerySystemInformation","ZwQueryInformationThread","PsGetProcessPeb","PsGetThreadTeb","PsGetCurrentProcessWow64Process","KeTestAlertThread","KeInitializeApc","KeInsertQueueApc","__C_specific_handler","PsThreadType","RtlCopyUnicodeString","KeResetEvent","ZwWriteFile","RtlRandomEx","RtlCreateUnicodeString","RtlDowncaseUnicodeString","ZwCreateEvent","ZwDeleteFile","ZwQueryInformationProcess","_vsnwprintf","ExEventObjectType","KeAcquireGuardedMutex","KeReleaseGuardedMutex","MmGetSystemRoutineAddress","RtlCaptureContext","KeCapturePersistentThreadState","ProbeForWrite","MmProbeAndLockPages","MmUnlockPages","MmBuildMdlForNonPagedPool","MmUnmapLockedPages","IoAllocateMdl","IoFreeMdl","ObCloseHandle","ZwOpenFile","RtlInsertElementGenericTableAvl","RtlDeleteElementGenericTableAvl","RtlLookupElementGenericTableAvl","RtlEnumerateGenericTableAvl","RtlIsGenericTableEmptyAvl","PsGetCurrentProcessId","ZwQueryVirtualMemory","MmHighestUserAddress","ExAllocatePool","MmIsAddressValid","PsGetProcessExitStatus","MmCopyVirtualMemory","ExEnumHandleTable","ExfUnblockPushLock","MmUserProbeAddress","RtlCompareUnicodeStrings"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Guangdong, L=Shenzhen, O=Shenzhen Huanan Xingfa Electronic Equipment Firm, CN=Shenzhen Huanan Xingfa Electronic Equipment Firm","ValidFrom":"2013-07-10 00:00:00","ValidTo":"2014-07-10 23:59:59","Signature":"453f89c72c0f43e9a0bea7aee4cc94137f22b1eed4c9970976ba0a64af4f248e9ed746472c54431e740ade4be5d3cf00a1b0e2138a54a137e2c5ca5d1485acfd4ce5deaf6bb98c4da4b98ed3f68123044bafa8fca57eecbe17acf2299a4c79ed76673280a7f930381406ecce5afad5aa28af71d68f48fff2b8f5944687e941ed507bfbe4b9b1a5075aa9493c083cabcad2e564e52fed0427eebce1880094f83c8a049638b826dbc9ab313354e9fc7938e6c57ad7450514abec83f28229b6ff7a208e6b3e9b059f2c439e2ecb0e143858a7748bcfc7750111a5a7dbb30f32906cafabd4f23c80f3752296e54b3aebef6b381ad065e070a271876ee77bad0d42e0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1cb2d523a6bf7a066642c578de1c9be4","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"65742dda29af02ee39af8b3c11f7469b","SHA1":"521f7a1f51ac74d4f29c599aa9dff8d466158438","SHA256":"33a7dcdd20164cdfa97f1af890a17ec28047093c116185a42dbcb77ceaabc769","SHA384":"c6ee18c1175e124cc37ceeb72251230868f8fe48e2052a1984b6b1b0975039de150f9a7cad5969f44d504ec0357ec8b1"}},{"Subject":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"56fe535ce1c79ebca7ed7e536d6a144b518c405e805faaa4e82fef38c804c9ca3ecfdf3a584eb0d4b663c52957fa02059a454d68db2a1bd4343d9f00c35acb9549a56ee1b0c5fc414d414a6fd377c8d7388de419de18f31f1565836d450c53f90a9a2ea55dbf6f32811892196a5500ad631c52067e55d92968ae4a7c189a79886b2323d827382a298776cafbc7b662231fed7a564cdd9c325bf53d0c4618953b2a2368836441d9006d0f1924156872bdc571676eac4cdb90eb51a51a6207d0be6a00473c722fec4f613e7385ce5a0ab7bac01c1375e3223928dd6d1d09469d4fbae8408191c6a4ce94721b01cf2a6e15679589ae7db7b7cdf90a3d75b66b3c25","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47974d7873a5bcab0d2fb370192fce5e","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"e3a93dc2a8a8a668fdbb286bfe9afab5","SHA1":"95795d2aa2a554a423bc8c6e5b0a016d14887d35","SHA256":"d8844186775bddbccaf3dc017064df7d760fd4b85c5d07561a3efd7da950f89e","SHA384":"78d972495720b43a6470b18ae1226bcca20707628087717a9364c14ca053ba264e6d149718b103542d9942200138a69d"}},{"Subject":"C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. , For authorized use only, CN=thawte Primary Root CA","ValidFrom":"2011-02-22 19:31:57","ValidTo":"2021-02-22 19:41:57","Signature":"2dcc71b5e8ba94ff5ee64467007b6afc412c3ee70e41855ab12a932ba95b89f2f72b499c8003f297b8e760a80ed7fd5de545467594f4ed1c9de166228b61fb29f2c6a8bdf387c98f7f47e1c058b64a1aa2e7f718606969e083069e26c775c40c0d79da746b52b9fae8ea3359b9bb18dd291a14dfd36a37277a9da0dacffffc22c4faf009ff33e93e17ba1cc742cfce2743d30c0c5581303db96060ce02ece19ee81ddc852ce0a18d966d95ac17a4713ea16741b6281d2ce3b615e5b7e5a2f6256d86e320acf9f8314f8e629b9833376d6af735523e90feb03b5fc5b852a9e06ea0479a279e97aea24a9e531939ec357ec659de3ae0aaf533f06abda0821812dea18c4570ca2bd62e959145995a5c240049bd23b30ceca43df5b9e1d1b1825a38eea3fba1ab483a8c5dffa065223fd3d3fe4990db1446a3852e8a554b09ab38b2ab63a008d1fdad48e273d812bcc26ca516fad09ac05e38383a2b718e553aac42197a1f0d4220e7ab5d8c6880524ca1c0d488d02321fb901309007b4937afa9df486022abf4f6c2363bf8513c34bbc586e43ae19f4b90fe5461024b159c34176aa94b8d4cb69d2326c83af1d6b805cdda1d6240183a2f1b41cd3a993a0aa9d1d77eb8c4aff7b8c980105ed55df6ce7a9a02c50f6381efb564e9fc5bd8d2619a68c37cf9c78df91e87d5fa2cf816ae9dab068fc86dc741cda14e84e3dac26ebcfb","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611fb0a400000000001d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a3f222107d4e1085e73b5b589c2f480b","SHA1":"b94aa26cd77c48d91a53ac44506cbd255e1d362c","SHA256":"a39ed0d6fd4eb1a6f7fed60f726e23eae668b7591bc004644625d22c701213fa","SHA384":"64b7643e4146016cbf83c911eb67e4601b6bb8d66f8ee8dcee67b815f91770d86ab23678b984430f22a963e5484881b7"}}],"Signer":[{"SerialNumber":"1cb2d523a6bf7a066642c578de1c9be4","Issuer":"C=US, O=Thawte, Inc., CN=Thawte Code Signing CA , G2","Version":1}]}],"LoadsDespiteHVCI":"TRUE"}]}