← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_85ca0dcd.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_85ca0dcd.sysSample 1 · HVCI TRUE
- MD5
0aa686c8c9c4d8379fdba2723c21663a- SHA1
995251de1b8f4d9a685ac39c3f0e1184c2b587b0- SHA256
85ca0dcdc52709de21281b8fc131a58440a045cf640643a6d96e5fee13a78b81- Imphash
ce10082e1aa4c1c2bd953b4a7208e56a- Authentihash MD5
4af5b2d8f0a016f5ec2af7100bee07cb- Authentihash SHA1
49d5f3b391f4cba970c5532c530305dde378e626- Authentihash SHA256
38050334f2043b6f42fccb934b4eebc9211755a0e9ad1485740351a272696f71- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_bfcbc010.sys binPath=C:\windows\temp\driver_bfcbc010.sys type=kernel && sc.exe start driver_bfcbc010.sysElevate privileges · Privileges: kernel · OS: Windows 10