← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_d9f15d91.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_d9f15d91.sysSample 1 · HVCI TRUE
- MD5
b71bbf5838a0346d567bc60e7955b642- SHA1
39ce3d1d083474ecbed453a0ec8344c66d51a4ac- SHA256
d9f15d91397d1c8d01b6d6871c4f18f3a85ca85f091a92f4e9221524344ca5fe- Imphash
70295ac5b1bb4091ca166a48afe3cd3a- Authentihash MD5
675127d3de10a429d442c797977175b7- Authentihash SHA1
fbc2e05f6c1e72e9c4c2d1d48ec8de888a52169f- Authentihash SHA256
2559a34af1cc5cd65bfd4334d053294046e05d833937e3b6fbfe7ddd381d0963- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_d9f15d91.sys binPath=C:\windows\temp\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sysElevate privileges · Privileges: kernel · OS: Windows 10