← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_5c308aed.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_5c308aed.sysSample 1 · HVCI TRUE
- MD5
7b3fcc6007d842c4b3235fe2327f4ab5- SHA1
e86dd3f83e40682407d499aa9ff6de1da8a2a143- SHA256
5c308aede12fefb8145c015a97d7844106df5469de97773cba3bd3d772dc7d24- Imphash
743ecae1e3cf27ca1ec49e662e4b8e86- Authentihash MD5
f62a8e4ecdb69735325921ef7aa282ef- Authentihash SHA1
9919e34fb9e04d9075a274365b66e52cc16f65e4- Authentihash SHA256
3768122b8ab7a518d3717cabdfdd7d9592ec986b3f85d40064fdf99c6f569f6b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10