← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_1a74c2bd.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_1a74c2bd.sysSample 1 · HVCI TRUE
- MD5
ecd42cec81bc4c08b1ffd99ab760581d- SHA1
5b4644ff543993f3b711fdd3e6cbaf52fd036092- SHA256
1a74c2bde0c9a76486657ccb9c79ea87c9891a32cdd4aa15c7542f7c9487a539- Imphash
93beecb302ac644a6548383c670392d3- Authentihash MD5
2d71d86287cd1e71b37f3fdb2846e607- Authentihash SHA1
102fa081caf22a17d0445526f17faaaa4c0eb3e0- Authentihash SHA256
44a89f82bf3303553f9a9fdf136b4453af6d4c777c95da57c5b8baca8506c272- Machine
- I386
- Version
- 1.0.0.1006
- Publisher
- Pinchins Technology Co.,Ltd.
Recorded command
sc.exe create driver_c3d48ddd.sys binPath=C:\windows\temp\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sysElevate privileges · Privileges: kernel · OS: Windows 10