← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_77225a99.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_77225a99.sysSample 1 · HVCI TRUE
- MD5
41d7ebdb73b4bf2a063ae430e33bc164- SHA1
4ebbaa7e0820e453ca82dab25bf8acde4ba87df2- SHA256
77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a7- Imphash
5ea7a944eb3873467dc30aafabea2752- Authentihash MD5
539c14f9f300778263bade546b1ec50e- Authentihash SHA1
d0b992a144c184a51a8d1463c12975eb62fc84b5- Authentihash SHA256
8e681ed97f08f8dc269c85b75160a508e59ba3045ddb14f99d64dd767dc556ba- Machine
- AMD64
- Version
- 6.32.3.80
- Publisher
- Tonec Inc.
Recorded command
sc.exe create driver_c3d48ddd.sys binPath=C:\windows\temp\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sysElevate privileges · Privileges: kernel · OS: Windows 10