CmdID

CmdID / Files

attrib.exe

Attribute Utility file version info

Program on Windows 12 known copies with hashes 5 Sigma rules name it Command attrib

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real attrib.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAttribute Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\attrib.exe · signed by Microsoft Windows

67416f3a21d001aa59136ea3213696e3e7df5d7e98af6733d5bfb9c08f602458

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\attrib.exe · signed by Microsoft Windows

f7aa440ac4f58e40edc76a84182f24dc7fece5879a58786dec1715f47907e394

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\attrib.exe · signed by Microsoft Windows

1043111ff07814b0d3439561b4cee5d7ec1799a7a0a419949fee707666f6dded

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\attrib.exe · signed by Microsoft Windows

1dd136cd5b90c2abc4f163429a99ed32a7d4b047407df45d96e20130f8b14920

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\attrib.exe · signed by Microsoft Windows

96f9a8bdfe0dc0452e64313a77a82c9460d31f5dd59c7ec676a9f83bd0ea8cd9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\attrib.exe · signed by Microsoft Windows

c8ee140e1c7908d7fded57d33d5edb0f43366a00df027abfbeb04032604e5dcc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\attrib.exe · signed by Microsoft Windows

b0fa083d8276ede756d9e525b18eebc9067357747228f0d965d452fa194e0c47

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\attrib.exe · signed by Microsoft Windows

b101350bceeb773b7e77759613bb33c28fbf1d79a13c2cb783575a9d893d52e6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\attrib.exe · signed by Microsoft Windows

72eebae5dae45019942e5542c77007496374e305c234f110467841f46d381374

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\attrib.exe · signed by Microsoft Windows

f9f41ee710dca39eff229f5277af4e3a24edf7eca6dfb2627ac3fefc934907b2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\attrib.exe · not signed

b433ea2114390c85a1c662494b432d4c731eb64d350bf31501afcab579a058a4

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\attrib.exe · not signed

ebe94e294d86c714bed13ef018e70f75c37f8d8259144c0c847637edc0222ecb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name attrib.exe
highSet Suspicious Files as System Files Using Attrib.EXENasreddine Bencherchali (Nextron Systems)
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumHackTool - Jlaive In-Memory Assembly ExecutionJose Luis Sanchez Martinez (@Joseliyo_Jstnk)
mediumHiding Files with Attrib.exeSami Ruohonen
lowSet Files as System Files Using Attrib.EXEfrack113