CmdID

CmdID / Files

calc.exe

Windows Calculator file version info

Program on Windows 12 known copies with hashes 20 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real calc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Calculator

12 known copies

10.0.22000.51 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\calc.exe · signed by Microsoft Windows

dafddb714343fd6d737db5859d84f3add82a6573aae679bbea32007f5d6245a5

10.0.22000.51 (WinBuild.160101.0800) · C:\WINDOWS\system32\calc.exe · signed by Microsoft Windows

f2550ccd41feac674be7a869dc6f69ab32a8d13d3fa5eff00d76105cc7451c78

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\calc.exe · signed by Microsoft Windows

58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\calc.exe · signed by Microsoft Windows

b183bd6414c5123465075d76d2413c999d569492fb543acbc29690b4b745bdf2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\calc.exe · signed by Microsoft Windows

1e09efa45db40fe1803e421ef090b82494600cbad1a5184be4b7b4158b62b642

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\calc.exe · signed by Microsoft Windows

a103a57d50b32469c5811e2808f021adf9d9220093b540b8a9c83b5c821d370e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\calc.exe · signed by Microsoft Windows

3091e2abfb55d05d6284b6c4b058b62c8c28afc1d883b699e9a2b5482ec6fd51

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\calc.exe · signed by Microsoft Windows

381a38d6e7a146b99e2be866b9e95ffe31f0dcfcec62272c7c0d6b7114c9227f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\calc.exe · signed by Microsoft Windows

b093fd472121cda0bbb1e0079479de36325f1b2faa7fda54c4f757565572fe1d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\calc.exe · signed by Microsoft Windows

c74f41325775de4777000161a057342cc57a04e8b7be17b06576412eff574dc5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\calc.exe · not signed

0cd81d97ad2d2809a9b516a1697a887e21ef7620591f9cb4cbc437e83230baf2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\calc.exe · not signed

5543a258a819524b477dac619efa82b7f42822e3f446c9709fadc25fdff94226

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name calc.exe
highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highSdiagnhost Calling Suspicious Child ProcessNextron Systems, @Kostastsale
highSuspicious Calculator UsageFlorian Roth (Nextron Systems)
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process of AspNetCompilerNasreddine Bencherchali (Nextron Systems)
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems)
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords)
mediumLOLBIN Execution From Abnormal DriveChristopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman
mediumPotential Provlaunch.EXE Binary Proxy Execution AbuseNasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)
mediumPotentially Suspicious Child Process Of VsCodeNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems)
mediumWSL Child Process AnomalyNasreddine Bencherchali (Nextron Systems)

Sigma names calc.exe in 20 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.