Cruciferra — Crypter-as-a-Service with EDR Blinding

Cruciferra is a subscription crypter, not a campaign. Proofpoint published the authoritative technical analysis on 2026-07-20. The service has been sold on underground forums (advertised on exploit[.]in as "the underground's most lethal crypter") since autumn 2025 at $450 to $2,000 USD per month, tiered by feature set. It is written in Mono, it is used by multiple unrelated criminal crews, and its only job is to get somebody else's payload to run without an EDR ever getting a clean look at it.

The attacker objective is visibility denial. Before a single byte of payload touches memory, Cruciferra reads a clean ntdll.dll off disk to build indirect syscall stubs, repairs the Import Address Table, unhooks user-mode API hooks, and — where it can — drops a vulnerable signed kernel driver and uses DeviceIoControl to terminate the security agent's own processes. It then escalates via the COM Elevation Moniker if it is not already elevated, writes a Run-key, suppresses Windows toast and balloon notifications so the user never sees a warning, decodes the payload out of the PE .reloc section with a custom Base16 alphabet, and executes it through a Process Ghosting variant that additionally patches ZwQueryVirtualMemory and neuters NtManageHotPatch so the ghosted image cannot be validated.

The highest-value defensive angle is the driver. Every other stage of this chain is deliberately engineered to be unobservable from user mode. The BYOVD stage is not: loading a kernel driver is a kernel-mediated, logged, and blockable event, and Cruciferra ships a small, enumerable set of eight vulnerable helper drivers. Hunt and block there first, then work outward to the artefacts the crypter cannot hide because they are persisted by the OS on its behalf: the Run value named putty, the notification-suppression registry trio, and the archive-borne EXE+DLL side-loading pair.

Payloads seen behind it: Agent Tesla, AsyncRAT / DCRAT, DarkCloud Stealer, Formbook, XLoader, PhantomStealer, Remcos, Snake Keylogger, ValleyRAT (Winos4.0), XWorm, and zgRAT. Because the crypter is shared, a Cruciferra hit tells you very little about who is in the environment and a great deal about what will happen next: a commodity RAT or stealer with credential-theft and follow-on-access intent.

Scope note. One named customer, the Chinese-linked actor TA4922, ran tax-themed lures against Indian taxpayers between April and June 2026 (tracked elsewhere as Operation DragonReturn, and already covered by OperationDragonReturn-Hunt in this library). That campaign is referenced here only as evidence of the service's customer base. Everything in this pack targets Cruciferra's own loader behaviours so it fires regardless of which crew bought the build or what lure they used.

Defender priority: deploy the Microsoft vulnerable-driver blocklist and ASR rule 56a863a9-875e-4185-98a7-b882c64b5ce5 ("Block abuse of exploited vulnerable signed drivers") in Block mode today, and hunt Q1/Q2/Q3 for the eight named helper drivers across the last 90 days. If Cruciferra has already run with the BYOVD stage successful, your EDR telemetry for that host is untrustworthy for the window in question and the host must be triaged from kernel-side and network evidence, not from agent process telemetry.

Research decisions

• Scoped to the crypter, deliberately. The Proofpoint IOC table is dominated by TA4922 payload URLs on low-cost TLDs (.gu.cc, .love, .live) and Tax-Number archive hashes. Those are DragonReturn campaign artefacts and are excluded here to avoid duplicating an existing pack and to keep this pack useful against the other Cruciferra customers.
• Infrastructure IOCs kept are the non-TA4922 ones only: the XWorm and zgRAT C2s and the two staging hosts from the SSA and guest-complaint campaigns. Both staging hosts look like compromised legitimate sites (one serves out of a WordPress wp-includes path), so they ship as hunt and not prevent.
• Perishability. Proofpoint observed a freshly packed sample uploaded to VirusTotal every few minutes on 2026-07-09. Sample hashes are therefore near-worthless as a standing block; the driver hashes and the behavioural signatures are the durable half of this pack and should outlive the infrastructure by a year or more.
• No exploit or offensive detail is reproduced. The syscall and ghosting sequence is described only to the depth needed to name the telemetry it leaves behind.

Source snapshots for every citation are saved alongside this pack in Cruciferra-Crypter-Hunt-sources/. Every atomic indicator in §10 was traced back to that saved text mechanically before publication.

Attack chain

Hunt hypotheses (ordered by fidelity)

All values below appear verbatim in the Proofpoint analysis snapshot saved with this pack. TA4922 / Operation DragonReturn campaign infrastructure is deliberately excluded — see the existing OperationDragonReturn-Hunt pack.

BYOVD helper drivers (durable — the core of this pack)

Non-TA4922 Cruciferra infrastructure and samples (perishable)

Behavioural indicators (no expiry — these are the pack's real value)

These cover the surfaces Falcon telemetry does not reach, and give you a second, independent opinion on the BYOVD stage — which matters precisely because the BYOVD stage is aimed at the EDR agent.

N1 · Mail gateway — archive and disk-image delivery

Search the last 90 days for inbound mail carrying, or linking to, .zip, .rar, .7z, .vhd, .vhdx, .img or .iso where the archive contains an executable, and for PDF attachments containing outbound links to newly registered or low-cost TLDs. Pivot on the three known lure themes: tax authority, social security correspondence, and guest / customer complaint with "evidence" links.

N2 · Windows Code Integrity log — driver load attempts

Read Microsoft-Windows-CodeIntegrity/Operational: EID 3033 (a driver failed validation) and EID 3063 (a driver was blocked by policy). If the Microsoft vulnerable-driver blocklist is enabled, a blocked Cruciferra BYOVD attempt lands here even when the endpoint agent has already been degraded.

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-CodeIntegrity/Operational'
    Id      = 3033,3063
    StartTime = (Get-Date).AddDays(-90)
} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, Message |
  Sort-Object TimeCreated -Descending

N3 · Sysmon EID 6 — driver load with signature status

Where Sysmon is deployed, EID 6 gives you the loaded driver's image path, hashes, Signature and SignatureStatus — the signer detail Falcon does not publish as a queryable field. Filter for the eight helper-driver names and for any driver loading out of a non-System32\drivers path.

N4 · Offline memory sweep — ghosted image sections

On a host with a confirmed Q1/Q2/Q3 hit, do not rely on the live agent. Acquire memory and look for committed image-backed regions whose backing FILE_OBJECT is marked for delete or no longer resolves, and for a process whose main image path does not exist on disk. Volatility's malfind plus a ldrmodules cross-check will surface a mapped image absent from all three PEB lists.

N5 · Offline PE triage — Cruciferra packing handles

For suspect binaries pulled from an incident: check for (a) a .reloc section that is far larger than its relocation table needs to be, (b) an export table with hundreds or thousands of entries pointing at junk, and (c) File Version Information whose Copyright / Product / Description are stitched pseudo-words. Any two of the three is a strong Cruciferra call.

Get-ChildItem -Path 'C:\Users' -Include *.dll,*.exe -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object {
      $v = $_.VersionInfo
      [pscustomobject]@{
          Path      = $_.FullName
          Company   = $v.CompanyName
          Product   = $v.ProductName
          Copyright = $v.LegalCopyright
          Signed    = (Get-AuthenticodeSignature $_.FullName).Status
      }
  } |
  Where-Object { $_.Signed -ne 'Valid' -and $_.Copyright -match '^\d{4} \w{8,} \w{8,}' }

N6 · Registry sweep — persistence and notification suppression

$hits = @()
$hits += Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
         Select-Object -Property putty -ErrorAction SilentlyContinue
$hits += Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications' -Name ToastEnabled -ErrorAction SilentlyContinue
$hits += Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name Balloon,ShowInfoTip -ErrorAction SilentlyContinue
$hits

None of these queries carry an in-query time filter. Set the window with the Falcon console time picker — the intended lookback is recorded as a // LOOKBACK: comment in each query. Start at 90 days for Q1 to Q3 and 30 days for the rest.

// HUNT: Cruciferra BYOVD helper driver written to disk
// MITRE: T1068, T1562.001 | CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten
// LOOKBACK: 90d (set in the console time picker)
// FALSE POSITIVES: MSI Afterburner (NTIOLib_X64.sys), Lenovo system tooling
//   (LnvMSRIO.sys), OEM PC-manager suites (HwOs2Ec.sys) legitimately install these.
// TUNING: exclude writes whose ContextBaseFileName is a known signed installer for
//   those suites, and exclude hosts in the engineering/overclocking asset group.
//   Do NOT exclude by driver name alone — GoFlyDrv.sys has no benign fleet use.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(Core64|GoFlyDrv|HwOs2Ec|LnvMSRIO|MemoryInformer|NTIOLib_X64|ProcessMonitorDriver|selfprot)\.sys$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Cruciferra published SHA256 set (8 BYOVD drivers + 1 packed loader)
// MITRE: T1068, T1027.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / PeFileWritten / NewExecutableWritten / ImageHash
// LOOKBACK: 90d (set in the console time picker)
// FALSE POSITIVES: none — exact hash match. A hit on an OEM driver hash still
//   means that exact vulnerable build is present and should be removed.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ImageHash)$/
| SHA256HashData=/^(17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4|2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a|c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c|c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809|7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8|09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1|5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df|c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0|3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d)$/i
| table([@timestamp, aid, ComputerName, UserName, SHA256HashData, FileName, ImageFileName, TargetFileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Cruciferra BYOVD helper driver loaded (kernel primitive obtained)
// MITRE: T1068, T1562.001 | CONF: high  FP: medium  COST: low
// REQUIRES: DriverLoad
// LOOKBACK: 90d (set in the console time picker)
// FALSE POSITIVES: OEM and overclocking utilities load NTIOLib_X64.sys,
//   LnvMSRIO.sys and HwOs2Ec.sys at boot from the System32 drivers directory.
// TUNING: exclude loads where ImageFileName sits under \Windows\System32\drivers\
//   AND the same aid shows the driver present for more than 30 days. Correlate every
//   surviving hit against a Q1 write on the same aid within the preceding hour.
#event_simpleName=/^DriverLoad$/
| ImageFileName=/\\(Core64|GoFlyDrv|HwOs2Ec|LnvMSRIO|MemoryInformer|NTIOLib_X64|ProcessMonitorDriver|selfprot)\.sys$/i
| groupBy([aid, ComputerName, ImageFileName, SHA256HashData], function=[count(as=Loads), min(@timestamp, as=FirstLoad), max(@timestamp, as=LastLoad)], limit=500)
| sort(FirstLoad, order=desc, limit=200)

// HUNT: EXE launched from an archive-extraction or Downloads path (side-load entry)
// MITRE: T1574.002, T1204.002 | CONF: medium  FP: high  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: portable utilities, developer toolchains, self-service installers,
//   and any org that ships software to users as a ZIP.
// TUNING: exclude ImageFileName values on your approved portable-app allowlist and
//   exclude the software-packaging and developer asset groups. Then rank what is left
//   by rarity of ImageFileName across the fleet — Cruciferra host EXEs are one-offs.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(explorer\.exe|winrar\.exe|7zFM\.exe|7zG\.exe|Bandizip\.exe|PeaZip\.exe|OUTLOOK\.EXE|msedge\.exe|chrome\.exe|firefox\.exe)$/i
| ImageFileName=/\\Users\\[^\\]+\\(Downloads|Desktop|OneDrive[^\\]*\\Downloads|AppData\\Local\\Temp\\(Rar\$[^\\]+|7z[^\\]+|Temp\d+_[^\\]+))\\[^\\]+\.exe$/i
| groupBy([ImageFileName, ParentBaseFileName], function=[count(as=Runs), count(aid, distinct=true, as=Hosts), collect([ComputerName, UserName, CommandLine])], limit=500)
| sort(Hosts, order=asc, limit=200)

// HUNT: Cruciferra Run-key persistence (value name "putty")
// MITRE: T1547.001 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// LOOKBACK: 90d (set in the console time picker)
// FALSE POSITIVES: essentially none — PuTTY does not install an autostart entry.
//   Widen the RegValueName filter to /^[a-z]{4,10}$/i to catch renamed builds; that
//   variant is noisier and should be reviewed rather than alerted.
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\Microsoft\\Windows\\CurrentVersion\\Run$/i
| RegValueName=/^putty$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Cruciferra notification-suppression registry cluster
// MITRE: T1112, T1562.001 | CONF: medium  FP: medium  COST: low
// REQUIRES: RegGenericValueUpdate / AsepValueUpdate
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: kiosk / signage provisioning, privacy-hardening GPOs, VDI
//   gold-image build scripts, and some OEM "clean desktop" utilities.
// TUNING: exclude your imaging and VDI build asset groups, and exclude hosts whose
//   hits all land inside a known provisioning window. What remains is a single user
//   endpoint flipping two or three of these in the same minute — that is the pattern.
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate)$/
| RegObjectName=/\\Microsoft\\Windows\\CurrentVersion\\(PushNotifications|Explorer\\Advanced)$/i
| RegValueName=/^(ToastEnabled|Balloon|ShowInfoTip)$/i
| groupBy([aid, ComputerName, UserName], function=[count(RegValueName, distinct=true, as=Distinct), count(as=Hits), collect([RegValueName, RegObjectName])], limit=500)
| test(Distinct >= 2)
| sort(Distinct, order=desc, limit=200)

// HUNT: COM Elevation Moniker UAC bypass — user-path child of dllhost.exe
// MITRE: T1548.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: OEM updaters, shell extensions and some installers legitimately
//   run surrogate-hosted out of AppData.
// TUNING: baseline the CLSID in the dllhost.exe parent CommandLine over 30 days and
//   exclude the CLSIDs that appear on more than 5 percent of the fleet. Then exclude
//   signed updater ImageFileName values you have already vetted.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^dllhost\.exe$/i
| ImageFileName=/\\Users\\[^\\]+\\(Downloads|Desktop|AppData\\(Local|Roaming))\\/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ParentProcessId_decimal, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Process Ghosting staging — extensionless / random-named PE in user Temp
// MITRE: T1055, T1140 | CONF: medium  FP: medium  COST: medium
// REQUIRES: PeFileWritten / NewExecutableWritten
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: installer bootstrappers (setup / msiexec chains), update agents,
//   and some browser and Office temporary-file handling.
// TUNING: exclude ContextBaseFileName values that write these on more than 20 hosts
//   (that is your benign installer and updater population), then review what is left.
//   Pivot every survivor to Q1 and Q7 on the same aid within a 10-minute window.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\Users\\[^\\]+\\AppData\\Local\\Temp\\[A-Za-z0-9]{6,64}$/i
| groupBy([ContextBaseFileName], function=[count(as=Writes), count(aid, distinct=true, as=Hosts), collect([ComputerName, UserName, TargetFileName])], limit=500)
| sort(Hosts, order=asc, limit=200)

// HUNT: DNS to published Cruciferra-linked C2 / staging hosts (non-TA4922 set)
// MITRE: T1071.001, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest / SuspiciousDnsRequest
// LOOKBACK: 90d (set in the console time picker)
// FALSE POSITIVES: none for the two C2 hostnames. digital-magicians.com and
//   almacensantangel.com look like compromised legitimate sites, so a resolution
//   there may be ordinary browsing — confirm the requesting process before escalating.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(gatuso\.duckdns\.org|0zbqnac1t4dv2t2wuodv1m\.com|digital-magicians\.com|almacensantangel\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName, RequestType])
| sort(@timestamp, order=desc, limit=500)

// HUNT: RAT beacon behind a Cruciferra loader — known C2 IP or dynamic-DNS egress
// MITRE: T1071.001, T1568.002 | CONF: medium  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 / DnsRequest
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: duckdns.org and similar dynamic-DNS providers are used
//   legitimately by remote-support tooling, home labs and some IoT devices.
// TUNING: exclude approved remote-support agents by ContextBaseFileName, and exclude
//   any dynamic-DNS hostname that has resolved on more than 10 hosts for over 60 days
//   (that is sanctioned tooling, not a commodity RAT).
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| (RemoteAddressIP4="89.34.90.99" or DomainName=/\.(duckdns|no-ip|ddns|hopto|serveo)\.(org|net|com|info|biz)$/i)
| ContextBaseFileName=/\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort_decimal])
| sort(@timestamp, order=desc, limit=500)

CQL review notes. All ten queries use verified Falcon data-model field names and carry no in-query time filter, so nothing breaks on the console's time picker. Two caveats worth knowing before you deploy: (1) DriverLoad in Q3 requires the sensor's kernel-driver telemetry to be flowing into your NG-SIEM repo — confirm with #event_simpleName=/^DriverLoad$/ | head(10) before trusting an empty result. (2) Q4 and Q8 are rarity hunts and are sorted ascending by host count on purpose: the interesting rows are at the top because they are rare, not because they are frequent.

Three of the ten queries are strong enough to promote to Custom IOAs. The rest stay Investigate-only. Deploy every IOA in Detect for two weeks first, review the hit set, then move to Prevent.

Deliberately not promoted

• Q4 and Q8 — rarity hunts with high benign volume. Promoting either would generate an unmanageable detection stream in any environment that distributes software as archives.
• Q6 — the notification-suppression cluster is a good corroborator but fires on legitimate imaging and VDI provisioning. Keep it as a scheduled search that feeds context onto other detections.
• Q2, Q9, Q10 — atomic-indicator hunts. These belong in Falcon IOC Management (see §10), not in a Custom IOA, because IOC Management handles expiry and bulk update and an IOA does not.

Deployment path: Falcon console → Endpoint security → Custom IOA rule groups → create a Windows rule group named Cruciferra-Crypter, add the three rules above, assign to a pilot prevention policy, then widen. Custom IOAs require the Falcon Prevent or Insight module; without them, run the three as scheduled searches with alerting instead.

Fourteen atomic indicators, every one traced back to the saved Proofpoint source snapshot before publication. The behavioural and driver blocks below are the durable half — use those when the hashes have aged out.

type,value,action,severity,expiration,description,tags
sha256,17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4,detect,high,2027-01-29,Cruciferra BYOVD helper driver Core64.sys,crypter:Cruciferra|ttp:T1068
sha256,2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a,detect,high,2027-01-29,Cruciferra BYOVD helper driver GoFlyDrv.sys used to terminate security processes,crypter:Cruciferra|ttp:T1562.001
sha256,c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c,detect,high,2027-01-29,Cruciferra BYOVD helper driver HwOs2Ec.sys,crypter:Cruciferra|ttp:T1068
sha256,c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809,detect,high,2027-01-29,Cruciferra BYOVD helper driver LnvMSRIO.sys,crypter:Cruciferra|ttp:T1068
sha256,7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8,detect,high,2027-01-29,Cruciferra BYOVD helper driver MemoryInformer.sys,crypter:Cruciferra|ttp:T1068
sha256,09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1,detect,high,2027-01-29,Cruciferra BYOVD helper driver NTIOLib_X64.sys,crypter:Cruciferra|ttp:T1068
sha256,5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df,detect,high,2027-01-29,Cruciferra BYOVD helper driver ProcessMonitorDriver.sys,crypter:Cruciferra|ttp:T1068
sha256,c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0,detect,high,2027-01-29,Cruciferra BYOVD helper driver selfprot.sys,crypter:Cruciferra|ttp:T1068
sha256,3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d,prevent,critical,2027-01-29,Cruciferra-packed zgRAT loader archive,crypter:Cruciferra|payload:zgRAT
domain,gatuso.duckdns.org,detect,high,2027-01-29,XWorm C2 behind a Cruciferra loader,crypter:Cruciferra|payload:XWorm
domain,0zbqnac1t4dv2t2wuodv1m.com,detect,high,2027-01-29,zgRAT C2 behind a Cruciferra loader,crypter:Cruciferra|payload:zgRAT
ipv4,89.34.90.99,detect,high,2027-01-29,zgRAT C2 on port 56001 behind a Cruciferra loader,crypter:Cruciferra|payload:zgRAT
domain,digital-magicians.com,hunt,medium,2026-10-29,Likely-compromised site staging a Cruciferra zgRAT archive - review before prevent,crypter:Cruciferra|stage:delivery
domain,almacensantangel.com,hunt,medium,2026-10-29,Likely-compromised WordPress staging a Cruciferra XWorm archive - review before prevent,crypter:Cruciferra|stage:delivery

# Cruciferra loader behaviours — durable, survive repacking
# Persistence
HKCU\Software\Microsoft\Windows\CurrentVersion\Run  value name: putty
# Notification suppression (2+ of these on one host in one minute)
HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications      ToastEnabled
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced      Balloon
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced      ShowInfoTip
# Privilege escalation
parent dllhost.exe  ->  child EXE under \Users\*\(Downloads|Desktop|AppData\(Local|Roaming))
# Payload staging (Process Ghosting)
PE written to \Users\*\AppData\Local\Temp\ with no file extension, then deleted
# Packing handles (offline triage)
payload stored in the PE .reloc section, Base16 with alphabet PQRSTUVWXYZ[\]^_
export table with hundreds-to-thousands of decoy exports pointing at junk code
File Version Info Copyright/Product/Description built from stitched pseudo-words
# Indirect syscall stub set resolved from a clean on-disk ntdll
NtProtectVirtualMemory NtCreateSection NtMapViewOfSection NtCreateTransaction
NtRollbackTransaction NtOpenKey NtSetValueKey NtClose NtSetInformationFile
# Anti-EDR extras layered on Process Ghosting
ZwQueryVirtualMemory hook patched to return sanitised results
NtManageHotPatch neutered to stop kernel validation of the ghosted image section

# Vulnerable helper drivers Cruciferra drops for BYOVD EDR tampering.
# GoFlyDrv.sys is the one named for terminating security processes.
# The other three marked OEM also ship with legitimate vendor software —
# validate fleet usage before moving from detect to block.
Core64.sys
GoFlyDrv.sys
HwOs2Ec.sys              # OEM PC-manager software also ships this
LnvMSRIO.sys             # OEM laptop tooling also ships this
MemoryInformer.sys
NTIOLib_X64.sys          # OEM overclocking utilities also ship this
ProcessMonitorDriver.sys
selfprot.sys
# Verify the Microsoft vulnerable-driver blocklist is actually on:
#   Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
#   reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable

# 1. Is the vulnerable-driver blocklist on?
(Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning

# 2. Is ASR "Block abuse of exploited vulnerable signed drivers" in Block mode?
#    GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 — value 1 means Block
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    '{0} = {1}' -f $p.AttackSurfaceReductionRules_Ids[$i], $p.AttackSurfaceReductionRules_Actions[$i]
}

# 3. Is HVCI / Memory Integrity enforced?
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' -Name Enabled

# 4. Is UAC set to always prompt on the secure desktop?
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name EnableLUA,ConsentPromptBehaviorAdmin,PromptOnSecureDesktop

# 5. Can users still mount ISO/VHD by double-clicking?
Get-ItemProperty 'HKLM:\SOFTWARE\Classes\Windows.IsoFile\shell\mount' -ErrorAction SilentlyContinue

Gate 1 — Telemetry ready

• #event_simpleName=/^DriverLoad$/ | head(10) returns rows. If it does not, Q3 is dead in your tenant and Q1/Q2 carry the whole BYOVD detection.
• #event_simpleName=/^AsepValueUpdate$/ | head(10) returns rows with RegValueName populated. If RegValueName is empty, Q5 and Q6 will silently return nothing.
• #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ | head(10) returns rows with ContextBaseFileName populated — Q1 and Q8 both group on it.
• Registry and file telemetry are policy-gated in some Falcon deployments. Confirm the sensor policy for your pilot group has both enabled before concluding a hunt came back clean.

Gate 2 — Benign baseline

• Run Q1 and Q3 with the driver-name filter removed and group by driver name over 90 days. That is your legitimate driver population; the three OEM names should dominate and should sit under System32\drivers.
• Run Q4 and Q8 for 30 days and record the top 20 ContextBaseFileName and ImageFileName values. Those are your exclusions. Anything appearing on one or two hosts is what you are actually hunting.
• Run Q7 and record every CLSID appearing in the dllhost.exe parent CommandLine. Anything on more than 5 percent of the fleet is sanctioned COM, not an elevation bypass.
• Q5 should return zero rows in a healthy environment. If it returns anything at all, treat it as a finding, not a baseline.

Gate 3 — Positive tests (lab only, never production)

• In an isolated VM, create HKCU\...\CurrentVersion\Run value putty pointing at a benign EXE in AppData. Q5 must fire within the sensor's registry flush interval.
• Set ToastEnabled, Balloon and ShowInfoTip in one script run. Q6 must return that host with Distinct of 2 or 3.
• Write a benign extensionless PE into %LOCALAPPDATA%\Temp under a random 8-character name. Q8 must return the writing process.
• Do not attempt to reproduce the BYOVD, unhooking or ghosting stages. Validate Q1 to Q3 by copying one of the named driver files (without loading it) into a user path and confirming Q1 fires.

Gate 4 — Promotion criteria

• An IOA moves from Detect to Prevent only after 14 days with zero unexplained hits and a documented exclusion list.
• The Q1-derived file-creation IOA is the exception: it is safe to deploy directly in Prevent because the user-profile path constraint excludes every legitimate installer behaviour.
• The two hunt-action staging domains in §10 stay at hunt until someone confirms the sites are still compromised. Blocking a recovered legitimate site is a self-inflicted outage.

Cruciferra's entire design assumes it gets to run user-mode code that can rewrite its own view of the OS. Detection buys you an alert after the fact; the controls below remove the capability. They are ordered by leverage, not by effort.

Raw, working configuration for the five highest-leverage controls. Every step carries prerequisites, reboot impact and a rollback — deploy nothing here without reading the rollback first.

Playbook 1 — Enable the Microsoft vulnerable-driver blocklist

Prerequisites: Windows 10 1809 or later / Windows 11 / Server 2019 or later; local administrator; Secure Boot recommended. Reboot required: yes, one reboot to take effect. Rollback: set the same value to 0 and reboot — documented in step 3 below.

#  1. Confirm current state
Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard |
    Select-Object SecurityServicesConfigured, SecurityServicesRunning, CodeIntegrityPolicyEnforcementStatus

#  2. ENABLE the Microsoft vulnerable-driver blocklist
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' `
                 -Name 'VulnerableDriverBlocklistEnable' -Value 1 -Type DWord
#     Reboot required. After reboot, blocked loads land in
#     Microsoft-Windows-CodeIntegrity/Operational as Event ID 3063.

#  3. ROLLBACK (if a business-critical driver is blocked)
#     Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' `
#                      -Name 'VulnerableDriverBlocklistEnable' -Value 0 -Type DWord
#     Reboot. Prefer replacing the offending driver over disabling the blocklist —
#     turning this off restores the exact capability Cruciferra depends on.

#  4. VERIFY after reboot
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-CodeIntegrity/Operational'; Id=3063} `
             -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message

Playbook 2 — ASR: block abuse of exploited vulnerable signed drivers

Prerequisites: Microsoft Defender Antivirus in active mode with real-time protection on; Windows 10 1803 or later. If Defender is in passive mode behind a third-party AV, ASR rules do not apply — use the WDAC route in Playbook 4 instead. Reboot required: no. Rollback: set the rule action to Disabled (step 3); takes effect immediately, no reboot.

#  1. AUDIT first — run for 7 days, review Defender Operational Event ID 1121/1122
Add-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
                 -AttackSurfaceReductionRules_Actions AuditMode

#  2. ENFORCE — move to Block once the audit set is clean
Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
                 -AttackSurfaceReductionRules_Actions Enabled

#     Optional: also block executable content dropped from mail and webmail clients,
#     which closes the delivery half of this chain.
#     Set-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 `
#                      -AttackSurfaceReductionRules_Actions Enabled

#  3. ROLLBACK
#     Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
#                      -AttackSurfaceReductionRules_Actions Disabled

#  4. VERIFY
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    '{0} = {1}' -f $p.AttackSurfaceReductionRules_Ids[$i], $p.AttackSurfaceReductionRules_Actions[$i]
}

Playbook 3 — Harden UAC against COM Elevation Moniker auto-elevation

Prerequisites: local administrator or GPO edit rights; communicate to users first, because they will start seeing consent prompts they did not see before. Reboot required: yes for EnableLUA changes; the consent-behaviour values apply at next logon. Rollback: restore the captured prior values from step 1 (the script writes them to disk before changing anything).

$key = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'

#  1. CAPTURE current values for rollback — do this first, always
Get-ItemProperty -Path $key -Name EnableLUA,ConsentPromptBehaviorAdmin,PromptOnSecureDesktop,EnableInstallerDetection |
    Export-Clixml -Path "$env:ProgramData\uac-rollback.xml"

#  2. APPLY
Set-ItemProperty -Path $key -Name 'EnableLUA'                 -Value 1 -Type DWord
Set-ItemProperty -Path $key -Name 'ConsentPromptBehaviorAdmin'-Value 2 -Type DWord   # prompt for consent on secure desktop
Set-ItemProperty -Path $key -Name 'PromptOnSecureDesktop'     -Value 1 -Type DWord
Set-ItemProperty -Path $key -Name 'EnableInstallerDetection'  -Value 1 -Type DWord

#     GPO equivalent: Computer Configuration - Windows Settings - Security Settings -
#     Local Policies - Security Options - "User Account Control: Behavior of the
#     elevation prompt for administrators in Admin Approval Mode" = Prompt for consent
#     on the secure desktop.

#  3. ROLLBACK
#     $old = Import-Clixml "$env:ProgramData\uac-rollback.xml"
#     Set-ItemProperty -Path $key -Name 'ConsentPromptBehaviorAdmin' -Value $old.ConsentPromptBehaviorAdmin
#     Set-ItemProperty -Path $key -Name 'PromptOnSecureDesktop'      -Value $old.PromptOnSecureDesktop
#     Reboot if EnableLUA was changed.

#  4. VERIFY
Get-ItemProperty -Path $key -Name EnableLUA,ConsentPromptBehaviorAdmin,PromptOnSecureDesktop

Playbook 4 — Deny execution from archive-extraction and user Temp paths (AppLocker)

Prerequisites: Application Identity service (AppIDSvc) set to Automatic; AppLocker requires Windows Enterprise or Education SKUs; build the allowlist from the Q4 and Q8 baselines before enforcing. Reboot required: no, but AppIDSvc must be started. Rollback: remove the rule from the AppLocker policy and re-import, or set enforcement back to AuditOnly — both take effect at the next policy refresh with no reboot.

#  1. PREREQUISITE — start the enforcement service
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

#  2. EXPORT the effective policy so you have a rollback artefact
Get-AppLockerPolicy -Effective -Xml | Out-File "$env:ProgramData\applocker-rollback.xml" -Encoding utf8

#  3. AUDIT FIRST. Create a Deny rule for the Everyone group covering:
#       %OSDRIVE%\Users\*\Downloads\*
#       %OSDRIVE%\Users\*\Desktop\*
#       %LOCALAPPDATA%\Temp\*
#     Set the Executable and DLL rule collections to AuditOnly, deploy for 14 days,
#     then review AppLocker EXE and DLL event logs (EventID 8003/8006) to build the
#     exception list. The DLL collection is the one that matters here — it is the
#     side-loaded DLL, not the signed EXE, that carries Cruciferra.

#  4. ENFORCE — flip the collections to Enabled once the exception list is stable
#     Set-AppLockerPolicy -XmlPolicy .\cruciferra-deny.xml -Merge

#  5. ROLLBACK
#     Set-AppLockerPolicy -XmlPolicy "$env:ProgramData\applocker-rollback.xml"
#     (or set EnforcementMode back to AuditOnly and re-merge)

#  6. VERIFY
Get-AppLockerPolicy -Effective -Xml | Select-String -Pattern 'Downloads|Temp'

Playbook 5 — Remove double-click mounting of ISO and VHD for standard users

Prerequisites: local administrator; confirm no business workflow depends on users mounting disk images (IT and developer groups often do — scope the GPO to exclude them). Reboot required: no; takes effect immediately for new Explorer sessions. Rollback: restore the exported registry keys from step 1.

#  1. EXPORT for rollback
reg export "HKLM\SOFTWARE\Classes\Windows.IsoFile"  "$env:ProgramData\isofile-rollback.reg"  /y
reg export "HKLM\SOFTWARE\Classes\Windows.VhdFile"  "$env:ProgramData\vhdfile-rollback.reg"  /y

#  2. APPLY — remove the shell "mount" verb so a double-click no longer mounts
reg delete "HKLM\SOFTWARE\Classes\Windows.IsoFile\shell\mount" /f
reg delete "HKLM\SOFTWARE\Classes\Windows.VhdFile\shell\mount" /f

#     Belt and braces: block the file types at the mail gateway as well (see
#     section 12, Immediate tier). Removing the verb does not stop PowerShell
#     Mount-DiskImage, so this is a usability control, not a hard boundary.

#  3. ROLLBACK
#     reg import "$env:ProgramData\isofile-rollback.reg"
#     reg import "$env:ProgramData\vhdfile-rollback.reg"

#  4. VERIFY — both should return "ERROR: The system was unable to find the
#     specified registry key or value"
reg query "HKLM\SOFTWARE\Classes\Windows.IsoFile\shell\mount"
reg query "HKLM\SOFTWARE\Classes\Windows.VhdFile\shell\mount"

Read this first. If Q3 fired — a vulnerable helper driver actually loaded — assume the endpoint agent was tampered with during the incident window. Do not use that host's own EDR process telemetry to decide scope. Build scope from network logs, identity logs, and neighbouring hosts instead.

Validation gates. Coverage claimed above is only real once §11 Gate 1 passes in your tenant — in particular Q3 depends on DriverLoad telemetry reaching your NG-SIEM repo, and Q5/Q6 depend on RegValueName being populated on registry events. Work Gate 2 (benign baseline) before promoting anything to an alert, and treat Gate 4 as the promotion contract. The three GAP rows are not oversights: unhooking, sandbox checks and console hiding leave no sensor-visible artefact by design, which is precisely why the hardening controls in §12 carry more weight than usual in this pack.