← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_290bc782.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_290bc782.sysSample 1 · HVCI TRUE
- MD5
3748096bd604a91bc26b2aa1c6883fce- SHA1
9b3a77a9be44abd750df60beba5bff92e47a96ee- SHA256
290bc7822da41f0b5580b27c8d14a2a5c3fbe3e4b6921957b134efc6beeb0aeb- Imphash
3dbe8de1ea987f3a487f28ce6f06feb7- Authentihash MD5
baf2e4ac70111b4a17bbaccee1eb5bc0- Authentihash SHA1
8a917b138cd94c029974780d57db2f5e5f63356f- Authentihash SHA256
d1598c68202647a9d029b0abb2737f3701359ab433677b51bd83459de7155677- Machine
- AMD64
- Version
- 6.2.9200.22099 (win8_ldr.170212-0600)
- Publisher
- Microsoft Corporation
Recorded command
sc.exe create driver_ef9d653a.sys binPath=C:\windows\temp\driver_ef9d653a.sys type=kernel && sc.exe start driver_ef9d653a.sysElevate privileges · Privileges: kernel · OS: Windows 10