← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_099ef491.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_099ef491.sysSample 1 · HVCI TRUE
- MD5
d0b0f38cf399bc1e7e4c387f50474601- SHA1
b5d1ce7fdd4d73271017b1e3916bb01729829cb8- SHA256
099ef4915d7899be543d891b48960c1d1604c55468c1377a6f71ce0e1a33c946- Imphash
fca0f3c7b6d79f494034b9d2a1f5921a- Authentihash MD5
bcf8a770e2ad301ebfa48c4969817830- Authentihash SHA1
17f3d1f610c4ec315b429187e9fb5eb428a33377- Authentihash SHA256
345ebed68c4e68aff5dd14c8df8524b69db4793845ca814bded608b246077792- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10