{"Id":"de62baae-872d-4e9a-b6d9-b0ac99854c66","Tags":["Chaos-Rootkit.sys"],"Verified":"TRUE","Author":"goosvorbook","Created":"2024-06-20","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create Chaos-Rootkit.sys binPath=C:\\windows\\temp\\Chaos-Rootkit.sys type=kernel && sc.exe start Chaos-Rootkit.sys","Description":"Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes and ability to restrict access to files except for whitelisted process work seamlessly on the latest Windows versions.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 11"},"Resources":["https://github.com/ZeroMemoryEx/Chaos-Rootkit"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"","MD5":"443e8d915c04c370b7c31bb5f11ebab7","SHA1":"c3f8b7f0995073abb58c2aec1b6062f89fe838a0","SHA256":"bdc73f752c1353d41e877d8bf42a1c53f0bba7d6f52348aaef60e06f4d3087d0","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Imphash":"0abe54d37cd1a70ed9041ab7d80318a9","Authentihash":{"MD5":"cec49dd8b1dbb091e3d6f8134cee5bdc","SHA1":"a4b5442d906715caaadc011d0c2fa44cd894dbfe","SHA256":"23be3616a4fb4e620f971e4348dc46b7980abca6463be3cb4b83769a955f2810"},"RichPEHeaderHash":{"MD5":"ae12000e18da8fac0c57ef3d7cd3236e","SHA1":"803fe53650c7d62f0652d87117cab64e01934e73","SHA256":"329187edf745b2d770774d2c1698151b8e63215b7bc7f56dceb4b2894efe0501"},"Sections":{".text":{"Entropy":5.914594854595524,"Virtual Size":"0x21c5"},".rdata":{"Entropy":4.584664357463394,"Virtual Size":"0xa74"},".data":{"Entropy":0.9644793977280222,"Virtual Size":"0x588"},".pdata":{"Entropy":3.7773529743020946,"Virtual Size":"0x15c"},"INIT":{"Entropy":4.897285864473433,"Virtual Size":"0x4f6"},".reloc":{"Entropy":3.756091254141947,"Virtual Size":"0x38"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-02-24 06:54:46","InternalName":"","Copyright":"","Imports":["FLTMGR.SYS","ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FltGetRequestorProcessId","KeWaitForSingleObject","ExInitializePushLock","ExAcquirePushLockExclusiveEx","ExReleasePushLockExclusiveEx","MmProbeAndLockPages","MmUnlockPages","MmProtectMdlSystemAddress","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","IoAllocateMdl","IofCompleteRequest","KeReleaseMutex","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","ObfDereferenceObject","NtCreateFile","PsReferencePrimaryToken","PsLookupProcessByProcessId","PsGetProcessImageFileName","__C_specific_handler","wcsstr","RtlCopyUnicodeString","DbgPrintEx","KeInitializeMutex","RtlGetVersion","DbgPrint","MmGetSystemRoutineAddress","IoCreateDevice","WdfVersionBindClass","WdfVersionUnbind","WdfLdrQueryInterface","WdfVersionBind","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"CN=WDKTestCert anash,133231280654008727","ValidFrom":"2023-03-12 20:54:25","ValidTo":"2033-03-12 00:00:00","Signature":"2877c0544f97abe3532296be49983e1e9b7f4c99ef327222c4b2b6d70194c8d97db7140a51dc6a18a009549aabe1bcb8c95d089917b9fed893b52f0518b649680aab7fdb5af9098de934aede339cee3d3c271ffc25c8d1b188fee3ff9a8b6591ac9f6e21934467db0d7d6595edcc98f3bbaf303202fab533ae82372da8d8b8dee1dcb80312e8ebe140ea9edfac35bf59e909b49edad358761784ffafb590665a6426e9b3fae943864a0484002555a654647e1495e92d9e8dafd00b0e36e30a921ec424e2d4a70d579879bdaaab9bc21824479b905e710ae1269e3fc3695c50811805f163e23590e53c173a79adda0fe1deb674f34fc0adf3cbcf93a4955907f7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"13d597c6ebaaaf994d4463d3387c0dd2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"6b552c6f192fd7c811a7f292b41dd282","SHA1":"fbd054373b922c03cad87c948c29ed2ed0883910","SHA256":"e9098f46ff7e02093422a6e4745f420d41fc08c66a95b6f62f09b44297bf35af","SHA384":"4b008e59d2ea4c49427250d7da08075c183e7759d91b9defaf47873d9dab76f2b9e17cd95aeee7ca99ea0967a3ceeb0f"}}],"Signer":[{"SerialNumber":"13d597c6ebaaaf994d4463d3387c0dd2","Issuer":"CN=WDKTestCert anash,133231280654008727","Version":1}]}],"LoadsDespiteHVCI":"TRUE"}]}