CmdID

CmdID / Files

TmComm.sys

TrendMicro Common Module file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/
https://www.loldrivers.io/drivers/d35cb48d-2aca-4d7d-a194-f4566183bcd9/

42 known samples

Show the 42 samples’ SHA-256 hashes

7.30.0.1099 · its entry

cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64

7.30.0.1078 · its entry

818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01

7.30.0.1065 · its entry

385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039

7.30.0.1065 · its entry

b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3

7.30.0.1049 · its entry

bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f

7.0.0.1176 · its entry

ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566

7.0.0.1101 · its entry

e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918

7.0.0.1099 · its entry

62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0

7.0.0.1099 · its entry

ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7

6.70.0.1140 · its entry

4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69

6.70.0.1129 · its entry

7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b

6.70.0.1129 · its entry

fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c

6.70.0.1128 · its entry

3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f

6.70.0.1121 · its entry

12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56

6.70.0.1117 · its entry

fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280

6.70.0.1106 · its entry

0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06

6.70.0.1098 · its entry

2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30

6.70.0.1078 · its entry

ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5

6.70.0.1073 · its entry

5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b

6.60.0.1084 · its entry

c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd

6.60.0.1082 · its entry

478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0

6.60.0.1056 · its entry

7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408

6.50.0.1058 · its entry

e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036

6.50.0.1041 · its entry

dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed

6.20.0.1008 · its entry

76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524

6.0.0.1072 · its entry

654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad

5.50.0.1124 · its entry

1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687

5.50.0.1091 · its entry

80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085

5.50.0.1070 · its entry

89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10

5.50.0.1070 · its entry

97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd

5.50.0.1047 · its entry

5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48

5.50.0.1033 · its entry

d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f

5.0.0.1113 · its entry

3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272

5.0.0.1104 · its entry

6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc

3.20.0.1012 · its entry

4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4

2.80.0.1077 · its entry

3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e

2.80.0.1063 · its entry

ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39

2.5.0.1121 · its entry

a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e

2.5.0.1106 · its entry

61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf

2.2.0.1016 · its entry

adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee

2.0.0.1118 · its entry

c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c

1.6.0.1052 · its entry

a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real TmComm.sys?

file version info and known copies
ProductTrend Micro Eyes, Trend Micro Inc.
DescriptionTrendMicro Common Module

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names TmComm.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.