CmdID / Files

7z.exe

7-Zip Console file version info

Program on Windows 1 known copy with hashes 6 Sigma rules name it

Is it the real 7z.exe?

file version info and known copies

Installed inC:\Program Files\7-Zip\

Product7-Zip, Igor Pavlov

Description7-Zip Console

1 known copy

19.00 · C:\Program Files\7-Zip\7z.exe · not signed

344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name 7z.exe

highUNC2452 Process Creation PatternsFlorian Roth (Nextron Systems)

medium7Zip Compressing Dump FilesNasreddine Bencherchali (Nextron Systems)

mediumCompress Data and Lock With Password for Exfiltration With 7-ZIPfrack113

mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)

lowPassword Protected Compressed File Extraction Via 7ZipNasreddine Bencherchali (Nextron Systems)

Sigma names 7z.exe in 6 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.