{"DetectionScope":"context-only","ResearchEvidence":{"Id":"f5c1a46f-21e6-4b06-b212-2dc55b699497","Tags":["driver_290bc782.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2024-09-10","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create driver_ef9d653a.sys binPath=C:\\windows\\temp\\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sys","Description":"Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"","MD5":"3748096bd604a91bc26b2aa1c6883fce","SHA1":"9b3a77a9be44abd750df60beba5bff92e47a96ee","SHA256":"290bc7822da41f0b5580b27c8d14a2a5c3fbe3e4b6921957b134efc6beeb0aeb","Signature":"","Date":"","Publisher":"","Company":"Microsoft Corporation","Description":"USB XHCI Driver","Product":"Microsoft® Windows® Operating System","ProductVersion":"6.2.9200.22099","FileVersion":"6.2.9200.22099 (win8_ldr.170212-0600)","MachineType":"AMD64","OriginalFilename":"usbxhci.sys","Imphash":"3dbe8de1ea987f3a487f28ce6f06feb7","Authentihash":{"MD5":"baf2e4ac70111b4a17bbaccee1eb5bc0","SHA1":"8a917b138cd94c029974780d57db2f5e5f63356f","SHA256":"d1598c68202647a9d029b0abb2737f3701359ab433677b51bd83459de7155677"},"RichPEHeaderHash":{"MD5":"02115f60728b8d35d4a53e4a6ad2b2c3","SHA1":"c756651881edd5a57905f54bc29a15f8cead3740","SHA256":"2d880a89fde5dff245fb7b54610989bda2dad16a7f76d0f56694eb97c7e1045a"},"Sections":{".text":{"Entropy":6.426837016161964,"Virtual Size":"0x35400"},"NONPAGE":{"Entropy":5.380500867500077,"Virtual Size":"0x158"},".rdata":{"Entropy":5.486890659497364,"Virtual Size":"0x340c"},".data":{"Entropy":2.301440855352113,"Virtual Size":"0x5b10"},".pdata":{"Entropy":5.560903620203367,"Virtual Size":"0x16ec"},"PAGE":{"Entropy":6.29126991754685,"Virtual Size":"0x8800"},"PAGEIPPT":{"Entropy":5.98352996511117,"Virtual Size":"0x387"},"INIT":{"Entropy":4.746451477847204,"Virtual Size":"0xcb2"},".rsrc":{"Entropy":3.7976584204281143,"Virtual Size":"0x6c00"},".reloc":{"Entropy":4.566850990422015,"Virtual Size":"0xc5c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2017-02-12 18:21:06","InternalName":"usbxhci.sys","Copyright":"© Microsoft Corporation. All rights reserved.","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IoGetDevicePropertyData","RtlFindMessage","KeReleaseMutex","KeDelayExecutionThread","wcsstr","KeFlushQueuedDpcs","EtwWrite","KeQueryTimeIncrement","IoSetDevicePropertyData","KeBugCheckEx","RtlCompareMemory","ObfDereferenceObject","IoEnumerateDeviceObjectList","MmLockPagableDataSection","IoGetDeviceProperty","DbgPrint","IoWMIRegistrationControl","EtwUnregister","MmGetSystemRoutineAddress","RtlGetVersion","EtwRegister","IoReuseIrp","KeReleaseSpinLockFromDpcLevel","RtlInitUnicodeString","IoSetCompletionRoutineEx","IoAllocateIrp","KeAcquireSpinLockAtDpcLevel","EtwRegisterClassicProvider","KeNumberProcessors","KeQueryDpcWatchdogInformation","MmUnmapIoSpace","MmMapIoSpace","IoBuildPartialMdl","MmBuildMdlForNonPagedPool","IoFreeMdl","RtlRunOnceInitialize","MmMapLockedPagesSpecifyCache","KeLowerIrql","IoAllocateMdl","EtwActivityIdControl","DbgPrintEx","PoSetHiberRange","MmUnlockPagableImageSection","KeWaitForSingleObject","KeReleaseSpinLock","RtlAnsiCharToUnicodeChar","RtlUnicodeToMultiByteN","KdRefreshDebuggerNotPresent","KeInitializeMutex","KeInitializeMutex","_stricmp","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItemEx","KeClearEvent","IoGetDmaAdapter","IoFreeIrp","KeAcquireSpinLockRaiseToDpc","RtlCopyUnicodeString","RtlCaptureContext","KeCapturePersistentThreadState","ExSystemTimeToLocalTime","RtlTimeToTimeFields","IoCreateFile","ZwClose","NtBuildNumber","ZwWriteFile","ZwOpenKey","ZwQueryValueKey","ZwOpenEvent","RtlSubAuthoritySid","RtlLengthRequiredSid","ZwAlpcSendWaitReceivePort","ZwCreateKey","ZwAlpcConnectPort","ZwQuerySystemInformation","EtwEventEnabled","ZwWaitForSingleObject","ZwFlushKey","RtlInitializeSid","ZwDeleteKey","ZwQueryKey","KeInitializeEvent","KeSetEvent","ExFreePoolWithTag","KfRaiseIrql","ExAllocatePoolWithTag","KeStallExecutionProcessor","WdfVersionUnbind","WdfVersionBind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Guangdong, L=Shenzhen, O=Shenzhen Jinxian Technology Co., Ltd., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Shenzhen Jinxian Technology Co., Ltd.","ValidFrom":"2014-01-07 00:00:00","ValidTo":"2015-01-07 23:59:59","Signature":"a83acfce8a36b3e49c9c29e35f2a209c21de96894006710f6832f206d6585d9be1e14accf18f94ef8b533703a7b3ee89bd654eca9e685f68dc14460e8aa5574b3f27e640f4bcbd2797a055a35c8b2679ded85dfecc8258c050d5530b9279841ff7a7ba1a4fb07e85d9295889d7a363b2b2919f4553d8ee31ea7d2547be42a1e4e150dccdb4fb542e6e8796bb50f0844f7dfc8ad1f37b8c00c86772bae78c995188cec0c21b164b3930c26a834cf5e094f0822e39373cfca6a16791a7f40a7761b429d0298ff89b01b6482308c94a7813438cc094fd5727abdac44e14f2545e2872d59850703d21b727354cffc4762aa7d629af5e784957cab3890463857db34f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"54871d9ab38d1902c32115f4c0797ea2","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"dd510df4937ec27c5fbf94479a760ec6","SHA1":"6e71e6434bc88648002a4a8893c21636154d5838","SHA256":"6c463c728b91efb5d946fc14f47421ae0f56592ae2023cb6b39974bdc0254dd9","SHA384":"63fc57001363ef7c8a503c5578908351f32948144962d78172234fcea44acd5448b81fe3e34020d93e7de2bcb4a66c9a"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=CN, O=JemmyLoveJenny PKI Service, OU=timestamp.pki.jemmylovejenny.tk, CN=Fake TimeStamp Responder","ValidFrom":"2000-01-01 00:00:00","ValidTo":"2099-12-31 23:59:59","Signature":"21ce1a74cffdc5be464c890b9ae11fe6f037b1145a8a3be179136f33eb4e74650c0d22055a26096e231fdc9be25bcfbe8d8d590d84d2443e19d0d8bb163e7d492162ba8f1ee020445d0338d6cf96bc7543da921f04874ae92a524585895d0f358b045c941ab49b34f287579f7d7aaa70122b519c8bb604c7f072ea20fb5e1b1c2c048f4c7e42dc6ee7caab6de80627c32632d0ea2756277ca3c98c2fa58a9d07364017c29844e99cac28cefc4d4bca807da970d2bdf548cec8844b5f72541940835e827c447773ed5b4e8114c2cf04d39bc2f2dc8c2ba8a6e67687e76b7805971e8b87096474fcac24da030e8d591f9edae5644199a235280d05761143af1292","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1eb132d57e7968960df26e854eb0dda6","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"5ab6e3eff526144c0498d28f2e8744cc","SHA1":"7ab94f2c92d6886a876615876fb3c7d996cc0ea3","SHA256":"ff83ab76196af2d3172c0be1ab23720770de769bed8daf815a059ca46df241af","SHA384":"9990f7fd996aa8f520b4d64eee4060d0009b6cd517416b7300245df65cb15eb72ab985f520bc02346c544d46ad172ae5"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}},{"Subject":"C=CN, O=JemmyLoveJenny PKI Service, OU=pki.jemmylovejenny.tk, CN=JemmyLoveJenny SHA1 TimeStamping Services CA","ValidFrom":"2000-01-01 00:00:00","ValidTo":"2099-12-31 23:59:59","Signature":"7a25039f8882f1960adb0b6781366e4e15e38a1b13b332e864e5b39e93128f9400648246af7f78526380ebc32a670c0d7184c0172442e5bdbb7873dac548349bbb5681f1f0b2e5fb7230153f95caaa5d7aeeb64cdc6f4cb9505f4b62b2e61f7b8856c43e91be32fc9918cd4ace9060388c8ef39c745adb7cbe0943353ae6c7e8f9e3a9a26da5fab1e43d7fafc02fa8433e1d9a3f3981c78f70c040e03c74258d5abca8231e3bff819e85f52d422dd507879f4e922b52f4ea358e887d8d3deb4bc81d5b3c42ae13aac56364c929da045225104ed04f3a041c9677cc731acbc153746b1f5e968cb468f52ab576515f967ce0159331e1ac575f27f4faf159ec70c3825d7366eb08f579909cab42adf8fe71c14f71d19326dad89dcd763ed3c4aad601c34aa8fa5ea6f16843d15692198c1c79f92c1d1feadeecae329206d02133c625875839baa3265b8e635a43c192755dfd260f0ffe7f2e320be8713639c0204fde54d92c59cb12c253b837e7fcbb3f1a47d7a1066a9568e1b5d9ddf1dc69da4bb6e5965dc72f35c5e8d78eca195cd7b18e41a12bb4eb4de8fc938b919c509871fcd1f808938bb5de8da978371b64ce5269a983f03d937c28a547ad3defd5d24c032fa67493cd00e9f0f835a3c22948ff71ec8c29eb66906ead31e09c6bd3fe0137bfcec27cd8bcbefed081fb2df4ee70ebe2d7c4b2a19419c2f3d79df8344236","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"1eb132d57e796896","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"953110dc4528bb8653d24128ec59f13b","SHA1":"3a111b3ec6c092f7181132509479ba73bc3c828f","SHA256":"3434a95dfbfdb4b2cdff9d76632bcfc1d8c9a2b805596ed3f8af1c97f61643b1","SHA384":"41c54e667a7ccaab3d4b6288e8c78789163e4adce5029f5e43de2a25ea9ad07bd3f4679538ebc301477917f46cfb8788"}}],"Signer":[{"SerialNumber":"54871d9ab38d1902c32115f4c0797ea2","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}],"LoadsDespiteHVCI":"TRUE"}]}}