← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_0a636606.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_0a636606.sysSample 1 · HVCI TRUE
- MD5
f7b6e5d30c5cee5f999578225d4cdfde- SHA1
48608c80ce98476569ee5bc51823f98dc80f858f- SHA256
0a6366066bc6003f347eadc6fe6c8994fded09fb7d5d24d0ddac3936ae1437a7- Imphash
fca0f3c7b6d79f494034b9d2a1f5921a- Authentihash MD5
85df7093d8b28abbae3cbe140f8c7078- Authentihash SHA1
1bcb334246a414c8c2236f44d658f59269799242- Authentihash SHA256
d342b077ec4b0fd3ced62d1e91911ac274c708e4ee513f52ec8f2cdd99d851f3- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10