← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_312c83a9.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_312c83a9.sysSample 1 · HVCI TRUE
- MD5
63366b4fb6f3b974900985ab064beb9b- SHA1
8d75f08e0ab4502ba0e871204723749596685232- SHA256
312c83a99928c30c1fc55a0a1e7571a63b0e04391abe3392115bb3b7e3f60f47- Imphash
bf06985f2031c08da05742e19dae38a7- Authentihash MD5
a57062ee04e84870dbf07ef6d82b92a1- Authentihash SHA1
5f511405488c103d94fceba1e8779e1d7f25ab9d- Authentihash SHA256
966cc215b2b8eb69aab3393114a10b7e07ba83df5b2587cb47fd3b172a3fa7cb- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10