CmdID

CmdID / Files

choice.exe

Offers the user a choice file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command choice

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real choice.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionOffers the user a choice

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\choice.exe · signed by Microsoft Windows

7e2b56d75c1c644236852b4e08e79d95de33dcc86416aff77b27fe50b7510c59

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\choice.exe · signed by Microsoft Windows

fb6ef3e6e2cdfc22ad75d999665cf64a4b02ca71aa2be08094153316c71d65f5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\choice.exe · signed by Microsoft Windows

b2191c32538842d3fdeff972e5a77527fa35d69fa400aad2aa2798b86fc6cf2a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\choice.exe · signed by Microsoft Windows

f6e5759793032bb3ce69658d0d4f0049a06e25fdc316d457846bb644212730af

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\choice.exe · signed by Microsoft Windows

a5a0b18ec249033cbc5629cc477ee81aa1b159c3f8b8eed4be95f4494d4b52bd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\choice.exe · signed by Microsoft Windows

c31a9d52fd3719b9a984ea8c8e911cc7f08d351c2567e0c165d5f95962df786b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\choice.exe · signed by Microsoft Windows

58900c00ba169518386d4f114a91edef83c2cc1040cc1a0210449f86b1104453

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\choice.exe · signed by Microsoft Windows

90f352c1fb7b21cc0216b2f0701a236db92b786e4301904d28f4ec4cb81f2a0b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\choice.exe · signed by Microsoft Windows

dbf371b359e27fd7595e4487235940ed2e92fd88021965c589c6723a5226ff70

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\choice.exe · signed by Microsoft Windows

df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\choice.exe · not signed

6dc1433c83950ae8cf06fae2248d9762b18f3d5b16b89b51750f5d87c625abfb

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\choice.exe · not signed

a0ac4ad10a633e0feab5d674818043fe2eab7814fdb6be67f0ce84cdbad46a6b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name choice.exe
highUncommon Child Process Of Setres.EXE@gott_cyber, Nasreddine Bencherchali (Nextron Systems)