Identifier / Programs / Windows
infdefaultinstall.exe
INF Default Install file version info (xCyclopedia)
LOLBAS Execute 1 ATT&CK technique 1 documented command 12 known copies with hashes
How infdefaultinstall.exe is abused
Execute T1218 System Binary Proxy Execution
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for infdefaultinstall.exe.
1 documented command
Execute T1218 System Binary Proxy Execution Admin privileges
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
InfDefaultInstall.exe {PATH:.inf}Trips 1 Sigma rule: mediumInfDefaultInstall.exe .inf Execution by frack113
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for infdefaultinstall.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for infdefaultinstall.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real infdefaultinstall.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
5.2.3668.0 · C:\Windows\SysWOW64\InfDefaultInstall.exe · signed by Microsoft Windows
0a07e8abedea7406f4f1bd0a2a10cc46fd9461d464118d23e2845eb68af26e1a5.2.3668.0 · C:\windows\system32\InfDefaultInstall.exe · not signed
0b63d3764337e6898e35481aaa2ffa0f5f5b802f2ea7cc202126550b445288595.2.3668.0 · C:\windows\SysWOW64\InfDefaultInstall.exe · not signed
134e40391e97a3ba5fe6e3b2433a430fce46d2a678fe2cfd15e48af59428a3755.2.3668.0 · C:\Windows\SysWOW64\InfDefaultInstall.exe · signed by Microsoft Windows
63805bf43b07576c68129b305a8d82e7adcdfc38812a1515e85d45229d94c26b5.2.3668.0 · C:\WINDOWS\SysWOW64\InfDefaultInstall.exe · signed by Microsoft Windows
8425cef86c050bf8f7e78dac0bfab8abcb9ae69c27e14c4cbc212f9bb20bd2d15.2.3668.0 · C:\Windows\system32\InfDefaultInstall.exe · signed by Microsoft Windows
84fcf22d7086a99b436ba4a39e61318881b8ca544d30d2e93412daa49795d8c45.2.3668.0 · C:\Windows\system32\InfDefaultInstall.exe · signed by Microsoft Windows
b9407fde5938ed7e2f467f85a465790d4bb9df4210678067c43d44d1c0bc7cd15.2.3668.0 · C:\Windows\SysWOW64\InfDefaultInstall.exe · signed by Microsoft Windows
c9295d491e4359b89083ae73920e8f2a41a73d52d0c46dd2dbaf34fd645a40325.2.3668.0 · C:\WINDOWS\system32\InfDefaultInstall.exe · signed by Microsoft Windows
d10352ec62db01410e49d0e38b5575ad81d1fab383222eaa7c30c3f05c632da05.2.3668.0 · C:\Windows\system32\InfDefaultInstall.exe · signed by Microsoft Windows
e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d5.2.3668.0 · C:\WINDOWS\system32\InfDefaultInstall.exe · signed by Microsoft Windows
e6283d2406c9b31c9a1f98cfea2c9b9daf44eb3d9b86b52bd253d5f83d7fc14e5.2.3668.0 · C:\WINDOWS\SysWOW64\InfDefaultInstall.exe · signed by Microsoft Windows
ef12da39388ca69b0a91930ab091dbf780aac7a2233b154c3912f744a40550dbFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.