mirror of
https://github.com/magicsword-io/LOLDrivers
synced 2026-06-08 15:38:06 +00:00
Cleanup on aisle 101
This commit is contained in:
Michael Haag
+1
-1
@@ -184,5 +184,5 @@ MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- myfile.exe
|
||||
- mimikatz.sys
|
||||
Verified: 'TRUE'
|
||||
+1
-1
@@ -217,5 +217,5 @@ MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- d3
|
||||
- netfilter.sys
|
||||
Verified: 'TRUE'
|
||||
@@ -1,206 +0,0 @@
|
||||
Acknowledgement:
|
||||
Handle: ''
|
||||
Person: ''
|
||||
Author: Michael Haag
|
||||
CVE:
|
||||
- ''
|
||||
Category: vulnerable drivers
|
||||
Commands:
|
||||
Command: ''
|
||||
Description: Confirmed vulnerable driver from Microsoft Block List
|
||||
OperatingSystem: Windows
|
||||
Privileges: kernel
|
||||
Usecase: Elevate privileges
|
||||
Created: '2023-07-22'
|
||||
Detection:
|
||||
- type: ''
|
||||
value: ''
|
||||
Id: 04f580fd-a5de-4172-87b2-109ca6081eed
|
||||
KnownVulnerableSamples:
|
||||
- Authentihash:
|
||||
MD5: 743d201f6bc28cef84e7f80979bbd591
|
||||
SHA1: 7a68999c9c27ce9f3709091bbc7bb9bd0ed2315c
|
||||
SHA256: 1cc70915340c82975727566bcdde5865a8bad3a357c3ac9b8ef2e444623be8e7
|
||||
Company: innotek GmbH
|
||||
Copyright: (C) 2004-2007 innotek GmbH
|
||||
CreationTimestamp: '2008-02-19 09:08:50'
|
||||
Date: ''
|
||||
Description: VirtualBox Display Driver
|
||||
ExportedFunctions:
|
||||
- AssertMsg1
|
||||
- AssertMsg2
|
||||
- RTCrc64
|
||||
- RTCrc64Finish
|
||||
- RTCrc64Process
|
||||
- RTCrc64Start
|
||||
- RTLogBackdoorPrintf
|
||||
- RTLogBackdoorPrintfV
|
||||
- RTLogFormatV
|
||||
- RTLogWriteUser
|
||||
- RTStrFormat
|
||||
- RTStrFormatNumber
|
||||
- RTStrFormatV
|
||||
FileVersion: 1.5.6.28241
|
||||
Filename: ''
|
||||
ImportedFunctions:
|
||||
- EngDeviceIoControl
|
||||
- EngAllocMem
|
||||
- EngCreateSemaphore
|
||||
- EngDeleteSemaphore
|
||||
- EngFreeMem
|
||||
- EngDeleteSurface
|
||||
- EngUnlockSurface
|
||||
- EngAssociateSurface
|
||||
- EngLockSurface
|
||||
- EngCreateBitmap
|
||||
- EngCreateDeviceSurface
|
||||
- EngDeletePalette
|
||||
- EngCreatePalette
|
||||
- PALOBJ_cGetColors
|
||||
- EngCopyBits
|
||||
- EngBitBlt
|
||||
- EngTextOut
|
||||
- EngLineTo
|
||||
- EngStretchBlt
|
||||
- EngPaint
|
||||
- EngFillPath
|
||||
- EngStrokePath
|
||||
- PATHOBJ_vGetBounds
|
||||
- CLIPOBJ_bEnum
|
||||
- CLIPOBJ_cEnumStart
|
||||
- BRUSHOBJ_pvGetRbrush
|
||||
- PATHOBJ_bEnum
|
||||
- PATHOBJ_vEnumStart
|
||||
- BRUSHOBJ_pvAllocRbrush
|
||||
- EngReleaseSemaphore
|
||||
- EngAcquireSemaphore
|
||||
Imports:
|
||||
- WIN32K.SYS
|
||||
InternalName: VBoxDisp.dll
|
||||
MD5: 05f400fea7f03ae0330d349013ebd33a
|
||||
MachineType: I386
|
||||
MagicHeader: 50 45 0 0
|
||||
OriginalFilename: VBoxDisp.dll
|
||||
PDBPath: ''
|
||||
Product: VirtualBox Guest Tools
|
||||
ProductVersion: 1.5.6.28241
|
||||
Publisher: ''
|
||||
RichPEHeaderHash:
|
||||
MD5: e6693e932a2cba52bdd649bc2518728a
|
||||
SHA1: e246a95659791515c454adfeca0a7522bdc5196f
|
||||
SHA256: 13df379d5416d51f502c097e2a082b18f65df609b55cbfb376166bb1aa59bd15
|
||||
SHA1: ffe743673f3de27f8810184fb35b315e2cf19c2b
|
||||
SHA256: 9a4e75da4609d08e1338c383727f5bb27accb13e8b491d1c22d7f21f4ddf91e5
|
||||
Sections:
|
||||
.text:
|
||||
Entropy: 6.452487966634651
|
||||
Virtual Size: '0x83a8'
|
||||
.rdata:
|
||||
Entropy: 3.8498709325870695
|
||||
Virtual Size: '0x1440'
|
||||
.data:
|
||||
Entropy: 5.543682562488848
|
||||
Virtual Size: '0x1548'
|
||||
.edata:
|
||||
Entropy: 4.821178153762516
|
||||
Virtual Size: '0x16f'
|
||||
INIT:
|
||||
Entropy: 5.055018497711608
|
||||
Virtual Size: '0x2f8'
|
||||
.rsrc:
|
||||
Entropy: 3.256105793257316
|
||||
Virtual Size: '0x3d0'
|
||||
.reloc:
|
||||
Entropy: 6.344888472907673
|
||||
Virtual Size: '0x4b2'
|
||||
Signature: ''
|
||||
Signatures:
|
||||
- CertificatesInfo: ''
|
||||
SignerInfo: ''
|
||||
Certificates:
|
||||
- Subject: C=DE, O=innotek GmbH, CN=innotek GmbH, emailAddress=info@innotek.de
|
||||
ValidFrom: '2007-12-27 14:37:17'
|
||||
ValidTo: '2010-12-27 14:37:17'
|
||||
Signature: 2a6d31919705290526ee3286d2825883af75a52ec1257276e9ab0eeff47a83adeab4bc2068eb7f76f84a356d466012e17b91d4f5c2913d28c73ee15018243e2ba7487f70d21f954eeeefb9854fc980d1ee61bf9a779e6e9a661938d7d9d6d101ddb49a9917264622f0ce4d63ac106b50769c38e9361a34f6cf5c5cae3ef50eb2a49d0f02c001af28d1f1fe250f2c99e5436b485a107eab17295180e5750eb31faee1ea0937a827bc140906a014b85409d8c48afbfcee20bf53f4e74661c1f555823c4bee18fde06e1e3e44fb8930e3ea84385e5006fd994fe8e69205a84ed7ed0f25c7b9f8fcb6f7d5b30188c27bf99050175afb1fc60f89ed2462ce999ca5dc
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: true
|
||||
SerialNumber: 010000000001171c092665
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: 5cfd8530475b20ed5a2bed70b37ee977
|
||||
SHA1: 4761dbd41ba2b01f21b9306ca21e8add93a30f09
|
||||
SHA256: 219041cc8d9e3248c69d9b116d440a0bbaa6aa500aa0c5de2d5af15908d83c7f
|
||||
- Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer ,
|
||||
G2
|
||||
ValidFrom: '2007-06-15 00:00:00'
|
||||
ValidTo: '2012-06-14 23:59:59'
|
||||
Signature: 50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: false
|
||||
SerialNumber: 3825d7faf861af9ef490e726b5d65ad5
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: d6c7684e9aaa508cf268335f83afe040
|
||||
SHA1: 18066d20ad92409c567cdfde745279ff71c75226
|
||||
SHA256: a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
|
||||
- Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
|
||||
ValidFrom: '2003-12-04 00:00:00'
|
||||
ValidTo: '2013-12-03 23:59:59'
|
||||
Signature: 4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: true
|
||||
SerialNumber: 47bf1995df8d524643f7db6d480d31a4
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: 518d2ea8a21e879c942d504824ac211c
|
||||
SHA1: 21ce87d827077e61abddf2beba69fde5432ea031
|
||||
SHA256: 1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
|
||||
- Subject: C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign
|
||||
Primary Object Publishing CA
|
||||
ValidFrom: '1999-01-28 12:00:00'
|
||||
ValidTo: '2014-01-27 11:00:00'
|
||||
Signature: a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: true
|
||||
SerialNumber: 04000000000108d9611cd6
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: 698f075151097d84c0b1f3e7bc3d6fca
|
||||
SHA1: 041750993d7c9e063f02dfe74699598640911aab
|
||||
SHA256: a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8
|
||||
- Subject: C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign
|
||||
CA
|
||||
ValidFrom: '2004-01-22 09:00:00'
|
||||
ValidTo: '2014-01-27 10:00:00'
|
||||
Signature: 11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: true
|
||||
SerialNumber: 04000000000108d9612448
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: 2fc76031fc24eec1ef3db2d246d21d6a
|
||||
SHA1: 75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d
|
||||
SHA256: 9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9
|
||||
- Subject: C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
|
||||
ValidFrom: '2006-05-23 17:00:51'
|
||||
ValidTo: '2016-05-23 17:10:51'
|
||||
Signature: 13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
IsCertificateAuthority: true
|
||||
SerialNumber: 610b7f6b000000000019
|
||||
Version: 3
|
||||
TBS:
|
||||
MD5: 4798d55be7663a75649cda4dedc686ef
|
||||
SHA1: 0f1ab2937b245d9466ea6f9bf056a5942e3989cf
|
||||
SHA256: ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1
|
||||
Signer:
|
||||
- SerialNumber: 010000000001171c092665
|
||||
Issuer: C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign
|
||||
CA
|
||||
Version: 1
|
||||
MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- VBoxDisp.dll
|
||||
Verified: 'TRUE'
|
||||
@@ -1808,9 +1808,172 @@ KnownVulnerableSamples:
|
||||
- SerialNumber: 112169417a1c3ef46a301f99385f50680fa0
|
||||
Issuer: C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2
|
||||
Version: 1
|
||||
- Authentihash:
|
||||
MD5: 93936f2a18b6a8501653ef021972d628
|
||||
SHA1: c08664c9293219c245006ff18ae75de42722ca60
|
||||
SHA256: be25688313f29d7e62c996572825c33f3dcdda373ec235efe552aeb2219990bb
|
||||
Company: ''
|
||||
Copyright: ''
|
||||
CreationTimestamp: '2013-08-17 16:23:52'
|
||||
Date: ''
|
||||
Description: ''
|
||||
ExportedFunctions: ''
|
||||
FileVersion: ''
|
||||
Filename: ''
|
||||
ImportedFunctions:
|
||||
- RtlCompareMemory
|
||||
- IoCreateSymbolicLink
|
||||
- IoCreateDevice
|
||||
- DbgPrint
|
||||
- PsProcessType
|
||||
- PsGetProcessImageFileName
|
||||
- PsReferencePrimaryToken
|
||||
- ZwOpenProcessTokenEx
|
||||
- ZwSetInformationProcess
|
||||
- ZwClose
|
||||
- ZwDuplicateToken
|
||||
- PsInitialSystemProcess
|
||||
- ObOpenObjectByPointer
|
||||
- IofCompleteRequest
|
||||
- PsDereferencePrimaryToken
|
||||
- ExAllocatePoolWithTag
|
||||
- ExFreePoolWithTag
|
||||
- IoEnumerateRegisteredFiltersList
|
||||
- ObfDereferenceObject
|
||||
- MmGetSystemRoutineAddress
|
||||
- CcMdlRead
|
||||
- SeImpersonateClientEx
|
||||
- PsSetCreateThreadNotifyRoutine
|
||||
- PsSetLoadImageNotifyRoutine
|
||||
- CmUnRegisterCallback
|
||||
- KeBugCheckEx
|
||||
- _vsnwprintf
|
||||
- IoDeleteDevice
|
||||
- RtlInitUnicodeString
|
||||
- NtBuildNumber
|
||||
- PsGetProcessId
|
||||
- IoDeleteSymbolicLink
|
||||
- PsGetVersion
|
||||
- ExAllocatePoolWithQuotaTag
|
||||
- ZwQuerySystemInformation
|
||||
- RtlUnwindEx
|
||||
- FltGetFilterInformation
|
||||
- FltEnumerateInstances
|
||||
- FltEnumerateFilters
|
||||
- FltObjectDereference
|
||||
- FltGetVolumeFromInstance
|
||||
Imports:
|
||||
- ntoskrnl.exe
|
||||
- FLTMGR.SYS
|
||||
InternalName: ''
|
||||
MD5: 84763d8ca9fe5c3bff9667b2adf667de
|
||||
MachineType: AMD64
|
||||
MagicHeader: 50 45 0 0
|
||||
OriginalFilename: ''
|
||||
PDBPath: ''
|
||||
Product: ''
|
||||
ProductVersion: ''
|
||||
Publisher: ''
|
||||
RichPEHeaderHash:
|
||||
MD5: 6931e969068f58678830e6bb4ee1ae49
|
||||
SHA1: bd694fda9f3f6b6a24e205b6027faf20b7d02b7a
|
||||
SHA256: 0ba61ea701b8a9e1bae7234e761b74c12b4262a3798d4525ce4b626affb6fc9a
|
||||
SHA1: 8b9dd4c001f17e7835fdaf0d87a2f3e026557e84
|
||||
SHA256: 2c14bea0d85c9cad5c5f5c8d0e5442f6deb9e93fe3ad8ea5e8e147821c6f9304
|
||||
Sections:
|
||||
.data:
|
||||
Entropy: 1.4269125817182893
|
||||
Virtual Size: '0x2b8'
|
||||
.pdata:
|
||||
Entropy: 3.9170697014365152
|
||||
Virtual Size: '0x1f8'
|
||||
.rdata:
|
||||
Entropy: 4.063554093583363
|
||||
Virtual Size: '0x940'
|
||||
.reloc:
|
||||
Entropy: 2.8064493688417227
|
||||
Virtual Size: '0xa4'
|
||||
.text:
|
||||
Entropy: 6.097853212616491
|
||||
Virtual Size: '0x37f6'
|
||||
INIT:
|
||||
Entropy: 5.100311543493838
|
||||
Virtual Size: '0x5cc'
|
||||
PAGE:
|
||||
Entropy: 6.079756252073022
|
||||
Virtual Size: '0x28b'
|
||||
Signature: ''
|
||||
Signatures:
|
||||
- Certificates:
|
||||
- IsCertificateAuthority: true
|
||||
SerialNumber: 0400000000012019c19066
|
||||
Signature: 5df6cb2b0d0140849f857a43706ae0c5e7aa0600d76713c9089131654f14a8a905dc389e6aa0300abd8dc78028ee4245ca94f3de5845a9803204f5595c6a70003927944df5b44634e81c5331b2b35416e9cc42abd5d959301cfb462725b88723b1e8758824831ec876377b01494548a4ede25dd27c9ca2dc2dba105a126265abae00c710343bcb72bd14240cdcc37627b4a7fee15829f20e169f91391d89a6e60f1c878ce258ac927e243eaaec14e73a33348bc63bac83ab0f14627aba1a2d4d4b1bc530f00b92797d3c78e0f8e6d215965999392b3061e8b8f8c0a1e9221411787dc4dc89bec0bb94e172aeebb540404fef171e585ed0a88996ac9228e9babf
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
Subject: OU=Timestamping CA, O=GlobalSign, CN=GlobalSign Timestamping CA
|
||||
TBS:
|
||||
MD5: 42023b9487cafe46c1b6a49c369a362e
|
||||
SHA1: 7c7b524d269334b9f073c32e888e09544c6acd98
|
||||
SHA256: b7126567833f3daa4085ff41e73112daad3d1e3808a942c1936520e2d6c46c78
|
||||
ValidFrom: '2009-03-18 11:00:00'
|
||||
ValidTo: '2028-01-28 12:00:00'
|
||||
Version: 3
|
||||
- IsCertificateAuthority: true
|
||||
SerialNumber: 0400000000012f4ee1355c
|
||||
Signature: 225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
Subject: C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2
|
||||
TBS:
|
||||
MD5: f6a9e8eb8784f3f694b4e353c08a0ff5
|
||||
SHA1: 589a7d4df869395601ba7538a65afae8c4616385
|
||||
SHA256: cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4
|
||||
ValidFrom: '2011-04-13 10:00:00'
|
||||
ValidTo: '2019-04-13 10:00:00'
|
||||
Version: 3
|
||||
- IsCertificateAuthority: false
|
||||
SerialNumber: 01000000000125b0b4cc01
|
||||
Signature: bc89ecfee63655935c79d4117a86808f17b693b26d9b91a1561811c655eaf608edad9b9ef52b81c8bbdd607b1b47991e6d403e1d80c213d58e04052fdbe7ae529e688472a1e54a603cf89bd52f46d8c3b2b79353ac9b6c432424d1f1fce9562e3411581843eaefff34746ca0c06c7fad031969881e9560cabbbd0cbb76efc724b081c63831cf36ad0c38b89020849b2e8f28b99ff6ca9427cdac396157e0e3955a9c769230f5dea6973d721c2a6032a8334d8635338a5cf3a4fdf7062ce16b4b30f5cbd34362f841b9de7d20cb058c8e2cf65f35fd338d42896508362ca389f45a858bb0b97bdb6ccba1f8d20e1bbb977cd12779be9d7c3be6a75634d8c991a9
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
Subject: C=BE, O=GlobalSign NV, CN=GlobalSign Time Stamping Authority
|
||||
TBS:
|
||||
MD5: e3369c8e5aec0504b3a50455f615d9f9
|
||||
SHA1: 13c244a894b40ecd18aaf97c362f20385bd005a7
|
||||
SHA256: 26da721a670c72836926032fee6920118bfb9bff89cc8d0ce30d9452c33f2532
|
||||
ValidFrom: '2009-12-21 09:32:56'
|
||||
ValidTo: '2020-12-22 09:32:56'
|
||||
Version: 3
|
||||
- IsCertificateAuthority: false
|
||||
SerialNumber: 112169417a1c3ef46a301f99385f50680fa0
|
||||
Signature: 7fb3e0f79a942f494fd6e5cd42f04eea33420dc8c6285b79807d4e8cd45ec65fa9a5abcf516482827302f51cc924e484461c67d6b3338ebbaf39129dda0b6d617a25bad53f7ed4af3c934bed8d683091e72b93668d6623670d9cc6d8f4999e896ec6c707d5acaddcae899be3ae42945efbd9e60a36bfb49e6fef09179f02c5c49059c159c2ccaf2e9e171dcd0476dfbffbb7f3a4d59a36ef9e7931aaab9c9821527e6081c2a57ce78863caaf81cb50537956191320b48053552b3ee2bc64878ae903105a8a4d4a85bf235040d02215601143aa9a304eeb5058354f9195069ceb08cdf1f07ec0575b64b0d1840947df070c3c65571226da895da14ac6ae5bd3b8
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
Subject: C=FR, CN=Benjamin Delpy
|
||||
TBS:
|
||||
MD5: ee0a53dda8301d1e78bd5487f1d49bf4
|
||||
SHA1: 5538f8cd492c2ec8d581f3665d2b4217c86fa19a
|
||||
SHA256: a39725e610e1a556e7bdfad56f59d24a5278073378a5d9880e14395bbd808deb
|
||||
ValidFrom: '2011-06-28 09:46:16'
|
||||
ValidTo: '2014-06-28 09:46:16'
|
||||
Version: 3
|
||||
- IsCertificateAuthority: true
|
||||
SerialNumber: 610b7f6b000000000019
|
||||
Signature: 13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.5
|
||||
Subject: C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
|
||||
TBS:
|
||||
MD5: 4798d55be7663a75649cda4dedc686ef
|
||||
SHA1: 0f1ab2937b245d9466ea6f9bf056a5942e3989cf
|
||||
SHA256: ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1
|
||||
ValidFrom: '2006-05-23 17:00:51'
|
||||
ValidTo: '2016-05-23 17:10:51'
|
||||
Version: 3
|
||||
CertificatesInfo: ''
|
||||
Signer:
|
||||
- Issuer: C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2
|
||||
SerialNumber: 112169417a1c3ef46a301f99385f50680fa0
|
||||
Version: 1
|
||||
SignerInfo: ''
|
||||
MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- mimikatz.sys
|
||||
Verified: 'TRUE'
|
||||
Verified: 'TRUE'
|
||||
@@ -177,5 +177,5 @@ MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- file
|
||||
- nvflash.sys
|
||||
Verified: 'TRUE'
|
||||
|
||||
@@ -1,240 +0,0 @@
|
||||
Acknowledgement:
|
||||
Handle: ''
|
||||
Person: ''
|
||||
Author: Michael Haag
|
||||
CVE:
|
||||
- ''
|
||||
Category: vulnerable drivers
|
||||
Commands:
|
||||
Command: ''
|
||||
Description: Confirmed vulnerable driver from Microsoft Block List
|
||||
OperatingSystem: Windows
|
||||
Privileges: kernel
|
||||
Usecase: Elevate privileges
|
||||
Created: '2023-07-22'
|
||||
Detection:
|
||||
- type: ''
|
||||
value: ''
|
||||
Id: 7f221b69-bdf6-41ad-a3a4-2a4a090005a3
|
||||
KnownVulnerableSamples:
|
||||
- Authentihash:
|
||||
MD5: 07d92a295ee543234903293c356f7934
|
||||
SHA1: 8081e736d0b4194aa8b3e7d321b6d87a4a202889
|
||||
SHA256: 55ecc80adf0c234708383190f79685086bccebc61382cae47ad10f19f5e68009
|
||||
Company: ''
|
||||
Copyright: ''
|
||||
CreationTimestamp: '2014-08-01 01:37:10'
|
||||
Date: ''
|
||||
Description: ''
|
||||
ExportedFunctions: ''
|
||||
FileVersion: 4.4.1.9596
|
||||
Filename: ''
|
||||
ImportedFunctions:
|
||||
- InitCommonControlsEx
|
||||
- SHGetPathFromIDListW
|
||||
- SHGetFileInfoW
|
||||
- CommandLineToArgvW
|
||||
- ShellExecuteW
|
||||
- ShellExecuteExW
|
||||
- SHGetMalloc
|
||||
- SHBrowseForFolderW
|
||||
- SHGetSpecialFolderLocation
|
||||
- CreateFileA
|
||||
- FreeLibrary
|
||||
- GetProcessHeap
|
||||
- HeapAlloc
|
||||
- GetLastError
|
||||
- GetProcAddress
|
||||
- HeapFree
|
||||
- LoadLibraryW
|
||||
- GetModuleFileNameW
|
||||
- LocalFree
|
||||
- WaitForSingleObject
|
||||
- CreateProcessW
|
||||
- SetCurrentDirectoryW
|
||||
- GetCurrentDirectoryW
|
||||
- CloseHandle
|
||||
- SetFileApisToOEM
|
||||
- GetCurrentProcess
|
||||
- GetCurrentThread
|
||||
- SetPriorityClass
|
||||
- GetEnvironmentVariableW
|
||||
- SetThreadPriority
|
||||
- GetVersionExW
|
||||
- GetModuleHandleW
|
||||
- ExpandEnvironmentStringsW
|
||||
- CreateFileW
|
||||
- GetCommandLineW
|
||||
- DeleteFileW
|
||||
- GetFileAttributesW
|
||||
- RemoveDirectoryW
|
||||
- CreateDirectoryW
|
||||
- FindClose
|
||||
- FindNextFileW
|
||||
- FindFirstFileW
|
||||
- FormatMessageW
|
||||
- InterlockedExchangeAdd
|
||||
- SetEndOfFile
|
||||
- SetFileTime
|
||||
- WriteFile
|
||||
- SetFilePointer
|
||||
- GetFileSize
|
||||
- ReadFile
|
||||
- MultiByteToWideChar
|
||||
- WideCharToMultiByte
|
||||
- InitializeCriticalSection
|
||||
- LeaveCriticalSection
|
||||
- EnterCriticalSection
|
||||
- DeleteCriticalSection
|
||||
- MoveFileW
|
||||
- lstrlenW
|
||||
- GetTempPathW
|
||||
- GetFullPathNameW
|
||||
- GetWindowsDirectoryW
|
||||
- GetTempFileNameW
|
||||
- SetFileAttributesW
|
||||
- GetLongPathNameW
|
||||
- ResetEvent
|
||||
- CreateEventW
|
||||
- SetEvent
|
||||
- FindResourceW
|
||||
- FileTimeToSystemTime
|
||||
- SetStdHandle
|
||||
- WriteConsoleW
|
||||
- GetConsoleOutputCP
|
||||
- WriteConsoleA
|
||||
- GetStringTypeW
|
||||
- GetStringTypeA
|
||||
- GetLocaleInfoA
|
||||
- LoadLibraryA
|
||||
- HeapReAlloc
|
||||
- VirtualAlloc
|
||||
- FlushFileBuffers
|
||||
- GetConsoleMode
|
||||
- GetConsoleCP
|
||||
- LCMapStringW
|
||||
- LCMapStringA
|
||||
- GetCurrentProcessId
|
||||
- GetTickCount
|
||||
- QueryPerformanceCounter
|
||||
- VirtualFree
|
||||
- HeapCreate
|
||||
- HeapDestroy
|
||||
- GetStartupInfoA
|
||||
- GetACP
|
||||
- WaitForMultipleObjects
|
||||
- ResumeThread
|
||||
- GetFileType
|
||||
- SetHandleCount
|
||||
- GetCommandLineA
|
||||
- GetEnvironmentStringsW
|
||||
- FreeEnvironmentStringsW
|
||||
- GetEnvironmentStrings
|
||||
- FreeEnvironmentStringsA
|
||||
- IsValidCodePage
|
||||
- TerminateProcess
|
||||
- UnhandledExceptionFilter
|
||||
- SetUnhandledExceptionFilter
|
||||
- IsDebuggerPresent
|
||||
- GetSystemTimeAsFileTime
|
||||
- GetVersionExA
|
||||
- GetStartupInfoW
|
||||
- ExitThread
|
||||
- GetCurrentThreadId
|
||||
- CreateThread
|
||||
- RaiseException
|
||||
- RtlUnwind
|
||||
- GetModuleHandleA
|
||||
- TlsGetValue
|
||||
- TlsAlloc
|
||||
- TlsSetValue
|
||||
- TlsFree
|
||||
- InterlockedIncrement
|
||||
- SetLastError
|
||||
- InterlockedDecrement
|
||||
- Sleep
|
||||
- HeapSize
|
||||
- ExitProcess
|
||||
- GetStdHandle
|
||||
- GetModuleFileNameA
|
||||
- GetCPInfo
|
||||
- GetOEMCP
|
||||
- TranslateMessage
|
||||
- IsWindowVisible
|
||||
- EnableWindow
|
||||
- GetMessageW
|
||||
- KillTimer
|
||||
- DispatchMessageW
|
||||
- PostQuitMessage
|
||||
- CreateDialogParamW
|
||||
- ScreenToClient
|
||||
- DestroyIcon
|
||||
- IsWindow
|
||||
- ShowWindow
|
||||
- MessageBoxW
|
||||
- PostMessageW
|
||||
- DialogBoxParamW
|
||||
- SetWindowPos
|
||||
- GetWindowRect
|
||||
- GetSystemMetrics
|
||||
- GetWindowTextW
|
||||
- SetWindowTextW
|
||||
- GetDlgItem
|
||||
- SendMessageW
|
||||
- EndDialog
|
||||
- SetFocus
|
||||
- LoadIconW
|
||||
- GetDesktopWindow
|
||||
- LoadStringW
|
||||
- SetTimer
|
||||
- IsDialogMessageW
|
||||
- DeleteObject
|
||||
- CreateSolidBrush
|
||||
- CoUninitialize
|
||||
- CoTaskMemFree
|
||||
- CoInitializeEx
|
||||
- CoCreateInstance
|
||||
- CoInitialize
|
||||
Imports:
|
||||
- COMCTL32.dll
|
||||
- SHELL32.dll
|
||||
- KERNEL32.dll
|
||||
- USER32.dll
|
||||
- GDI32.dll
|
||||
- ole32.dll
|
||||
InternalName: ''
|
||||
MD5: 85bd61f697d33131fd6609fbc7337ebf
|
||||
MachineType: I386
|
||||
MagicHeader: 50 45 0 0
|
||||
OriginalFilename: ''
|
||||
PDBPath: ''
|
||||
Product: ''
|
||||
ProductVersion: '4.4'
|
||||
Publisher: ''
|
||||
RichPEHeaderHash:
|
||||
MD5: dfcfc6a02ddd326f58049ed74c742afd
|
||||
SHA1: b7f6386a0252574ac5b2b5b7dc9c870426dce32d
|
||||
SHA256: f0dbb3a42d7c94e8ef47b0f7c5c36a6281a7623f7995a61413e616a96db583c0
|
||||
SHA1: eb1a5457010b07393ffd4c8c8206e83e737290ec
|
||||
SHA256: 272d3541491b145e93c47b225769ef65a53b5f8586ed6edb991f763ee5300417
|
||||
Sections:
|
||||
.text:
|
||||
Entropy: 6.629799424341935
|
||||
Virtual Size: '0x40475'
|
||||
.rdata:
|
||||
Entropy: 4.912185025833945
|
||||
Virtual Size: '0xcc84'
|
||||
.data:
|
||||
Entropy: 4.945319467301306
|
||||
Virtual Size: '0xa3e0'
|
||||
.rsrc:
|
||||
Entropy: 6.594798012652241
|
||||
Virtual Size: '0x121ac'
|
||||
Signature: ''
|
||||
Signatures: {}
|
||||
MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- powertools.exe
|
||||
Verified: 'TRUE'
|
||||
@@ -2547,9 +2547,205 @@ KnownVulnerableSamples:
|
||||
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft
|
||||
Windows Third Party Component CA 2012
|
||||
Version: 1
|
||||
- Authentihash:
|
||||
MD5: 5064073c3f84f1569377081c4ad33867
|
||||
SHA1: aca8e53483b40a06dfdee81bb364b1622f9156fe
|
||||
SHA256: 3d31118a2e92377ecb632bd722132c04af4e65e24ff87743796c75eb07cfcd71
|
||||
Company: ''
|
||||
Copyright: ''
|
||||
CreationTimestamp: '2021-05-15 06:44:55'
|
||||
Date: ''
|
||||
Description: ''
|
||||
ExportedFunctions: ''
|
||||
FileVersion: ''
|
||||
Filename: ''
|
||||
ImportedFunctions:
|
||||
- FwpsAcquireClassifyHandle0
|
||||
- FwpsReleaseClassifyHandle0
|
||||
- FwpmFilterDeleteById0
|
||||
- FwpsAcquireWritableLayerDataPointer0
|
||||
- FwpsApplyModifiedLayerData0
|
||||
- FwpmFilterAdd0
|
||||
- FwpmCalloutAdd0
|
||||
- FwpmSubLayerDeleteByKey0
|
||||
- FwpmSubLayerAdd0
|
||||
- FwpmTransactionAbort0
|
||||
- FwpmTransactionCommit0
|
||||
- FwpmTransactionBegin0
|
||||
- FwpmEngineClose0
|
||||
- FwpmEngineOpen0
|
||||
- FwpsCalloutUnregisterById0
|
||||
- FwpsCompleteClassify0
|
||||
- FwpsCalloutRegister1
|
||||
- IofCallDriver
|
||||
- IoCreateFile
|
||||
- IoFreeIrp
|
||||
- IoGetRelatedDeviceObject
|
||||
- ObReferenceObjectByHandle
|
||||
- ObfDereferenceObject
|
||||
- ZwQueryInformationFile
|
||||
- ZwSetInformationFile
|
||||
- ZwReadFile
|
||||
- ZwWriteFile
|
||||
- ZwClose
|
||||
- IoFileObjectType
|
||||
- KeEnterCriticalRegion
|
||||
- KeLeaveCriticalRegion
|
||||
- PsTerminateSystemThread
|
||||
- KeSetBasePriorityThread
|
||||
- sprintf
|
||||
- CmUnRegisterCallback
|
||||
- CmRegisterCallbackEx
|
||||
- CmCallbackGetKeyObjectID
|
||||
- MmIsAddressValid
|
||||
- strlen
|
||||
- strncmp
|
||||
- strncpy
|
||||
- wcscat
|
||||
- wcslen
|
||||
- wcsncmp
|
||||
- RtlInitAnsiString
|
||||
- strcat
|
||||
- strcmp
|
||||
- strncat
|
||||
- ExAllocatePoolWithTag
|
||||
- ExAcquireSpinLockExclusive
|
||||
- ExReleaseSpinLockExclusive
|
||||
- wcscpy
|
||||
- RtlAnsiStringToUnicodeString
|
||||
- RtlFreeUnicodeString
|
||||
- RtlCreateSecurityDescriptor
|
||||
- RtlSetDaclSecurityDescriptor
|
||||
- KeResetEvent
|
||||
- KeInitializeTimerEx
|
||||
- KeSetTimerEx
|
||||
- PsCreateSystemThread
|
||||
- ZwCreateKey
|
||||
- ZwOpenKey
|
||||
- ZwFlushKey
|
||||
- ZwQueryValueKey
|
||||
- ZwSetValueKey
|
||||
- NtQueryInformationToken
|
||||
- RtlLengthSid
|
||||
- RtlConvertSidToUnicodeString
|
||||
- RtlCreateAcl
|
||||
- RtlAddAccessAllowedAce
|
||||
- RtlSetOwnerSecurityDescriptor
|
||||
- PsLookupProcessByProcessId
|
||||
- ObOpenObjectByPointer
|
||||
- ZwOpenProcessTokenEx
|
||||
- ZwSetSecurityObject
|
||||
- PsGetProcessImageFileName
|
||||
- _allmul
|
||||
- PsProcessType
|
||||
- SeExports
|
||||
- strchr
|
||||
- strncpy_s
|
||||
- MmProbeAndLockPages
|
||||
- MmUnlockPages
|
||||
- IoAllocateMdl
|
||||
- IoFreeMdl
|
||||
- IoReuseIrp
|
||||
- IoAllocateIrp
|
||||
- RtlUnwind
|
||||
- KeWaitForSingleObject
|
||||
- KeSetEvent
|
||||
- KeInitializeEvent
|
||||
- KeGetCurrentThread
|
||||
- IoDeleteSymbolicLink
|
||||
- KeBugCheckEx
|
||||
- ExFreePoolWithTag
|
||||
- RtlInitUnicodeString
|
||||
- RtlCopyUnicodeString
|
||||
- strcpy
|
||||
- memset
|
||||
- memcpy
|
||||
- strstr
|
||||
- WskDeregister
|
||||
- WskReleaseProviderNPI
|
||||
- WskCaptureProviderNPI
|
||||
- WskRegister
|
||||
- KeGetCurrentIrql
|
||||
- WdfVersionBind
|
||||
- WdfVersionBindClass
|
||||
- WdfVersionUnbindClass
|
||||
- WdfVersionUnbind
|
||||
Imports:
|
||||
- fwpkclnt.sys
|
||||
- ntoskrnl.exe
|
||||
- NETIO.SYS
|
||||
- HAL.dll
|
||||
- WDFLDR.SYS
|
||||
InternalName: ''
|
||||
MD5: cb34374f1b5fb771076872c6b14b7501
|
||||
MachineType: I386
|
||||
MagicHeader: 50 45 0 0
|
||||
OriginalFilename: ''
|
||||
PDBPath: ''
|
||||
Product: ''
|
||||
ProductVersion: ''
|
||||
Publisher: ''
|
||||
RichPEHeaderHash:
|
||||
MD5: f0b684c190bdbac4aa311a7355122963
|
||||
SHA1: b7866474ab0a322b84086fccf1948d5a8b7f03a0
|
||||
SHA256: 33c5dfb8ba99a1d23f6a99cb34c04977b2455fa6c59e79dbad4d910516357bae
|
||||
SHA1: 118f688c30a2f6c2d1feb955f53ce4acf3086b3b
|
||||
SHA256: e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37
|
||||
Sections:
|
||||
.data:
|
||||
Entropy: 0.6890836305716007
|
||||
Virtual Size: '0x9428'
|
||||
.rdata:
|
||||
Entropy: 4.565535020821956
|
||||
Virtual Size: '0x5f4'
|
||||
.reloc:
|
||||
Entropy: 6.678416291453968
|
||||
Virtual Size: '0x694'
|
||||
.text:
|
||||
Entropy: 6.340579412340497
|
||||
Virtual Size: '0x5de8'
|
||||
INIT:
|
||||
Entropy: 5.674405086792681
|
||||
Virtual Size: '0xb48'
|
||||
Signature: ''
|
||||
Signatures:
|
||||
- Certificates:
|
||||
- IsCertificateAuthority: false
|
||||
SerialNumber: 33000000b5213fca1e4aa03de40000000000b5
|
||||
Signature: 0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.11
|
||||
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft
|
||||
Windows Hardware Compatibility Publisher
|
||||
TBS:
|
||||
MD5: a0dd89c33c4973bf6758331e200fb6de
|
||||
SHA1: 65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5
|
||||
SHA256: 29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47
|
||||
ValidFrom: '2020-12-15 22:15:33'
|
||||
ValidTo: '2021-12-02 22:15:33'
|
||||
Version: 3
|
||||
- IsCertificateAuthority: true
|
||||
SerialNumber: 610baac1000000000009
|
||||
Signature: 5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
|
||||
SignatureAlgorithmOID: 1.2.840.113549.1.1.11
|
||||
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft
|
||||
Windows Third Party Component CA 2012
|
||||
TBS:
|
||||
MD5: a569061297e8e824767dbc3184a69bea
|
||||
SHA1: adbb26a587a8f44b4fccaecb306f980d1c55a150
|
||||
SHA256: cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
|
||||
ValidFrom: '2012-04-18 23:48:38'
|
||||
ValidTo: '2027-04-18 23:58:38'
|
||||
Version: 3
|
||||
CertificatesInfo: ''
|
||||
Signer:
|
||||
- Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft
|
||||
Windows Third Party Component CA 2012
|
||||
SerialNumber: 33000000b5213fca1e4aa03de40000000000b5
|
||||
Version: 1
|
||||
SignerInfo: ''
|
||||
MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- Netfilter.sys
|
||||
Verified: 'TRUE'
|
||||
Verified: 'TRUE'
|
||||
@@ -613,4 +613,4 @@ KnownVulnerableSamples:
|
||||
MagicHeader: 50 45 0 0
|
||||
CreationTimestamp: '2007-11-17 01:40:29'
|
||||
Tags:
|
||||
- SANDRA
|
||||
- SANDRA.sys
|
||||
|
||||
@@ -846,9 +846,8 @@ KnownVulnerableSamples:
|
||||
Version: 1
|
||||
MitreID: T1068
|
||||
Resources:
|
||||
- ' https://github.com/jbaines-r7/dellicious'
|
||||
- ' https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/'
|
||||
- https://github.com/jbaines-r7/dellicious and https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
|
||||
- 'https://github.com/jbaines-r7/dellicious'
|
||||
- 'https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/'
|
||||
Tags:
|
||||
- sandra.sys
|
||||
Verified: 'TRUE'
|
||||
|
||||
@@ -256,5 +256,5 @@ MitreID: T1068
|
||||
Resources:
|
||||
- https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c
|
||||
Tags:
|
||||
- i8042prt
|
||||
- VBoxMouseNT.sys
|
||||
Verified: 'TRUE'
|
||||
|
||||
Reference in New Issue
Block a user