CmdID

CmdID / Files

clip.exe

Clip - copies the data into clipboard file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it Command clip

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real clip.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionClip - copies the data into clipboard

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\clip.exe · signed by Microsoft Windows

db10c74d475a4b8d31a726f7e09248b3c7cc71992548c1e724b936f9e75a9694

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\clip.exe · signed by Microsoft Windows

e840540406079c00b18cab60c62a95e5a884b762ef4c93e9a25af2829ec6ff88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\clip.exe · signed by Microsoft Windows

5ad606bcbbbdb95dda19c955e4129b436295cac249e2370fee3d0285d387cf55

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\clip.exe · signed by Microsoft Windows

6cdc8d3c147dcf7253c0fb7bb552b4ae918aba4058cc072a2320a7297d4fbed7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\clip.exe · signed by Microsoft Windows

b1fc6760432bad0591f5eefc461f54592de3ba7818b785b0dcf5128c0c6bf251

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\clip.exe · signed by Microsoft Windows

cb7ed224b854c6503928dab334f1e0e42cbbb9617b187e5e86acd4e03858879f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\clip.exe · signed by Microsoft Windows

32f91b0ce7278e96f19b134722ab5260990d59d1b3381116bc5078b860ae57a8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\clip.exe · signed by Microsoft Windows

79a0404570d2ae09ca66d7b68b3528679da03337ec1c6bc59ec8105df2417b1c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\clip.exe · signed by Microsoft Windows

b57333b76e5caabc4b8a8ae4264cd664e1eeec3cc4a7f6bed76c23d53b5418da

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\clip.exe · signed by Microsoft Windows

dd959663068e11ce7bb7ada4aa0636879a9bb454d7c0fd3085081ad4b1a78d1b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\clip.exe · not signed

3c677c3b2552414b11013deac07c80c12139f71d66064c8e0a255c92cc625e0c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\clip.exe · not signed

e0a3648bcc1f0f0aa9afd9e5031afe0897bc5a10fed9a1b7984adacd119b4f10

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name clip.exe
lowData Copied To Clipboard Via Clip.EXEfrack113

Sigma names clip.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.