CmdID

CmdID / Files

ctfmon.exe

CTF Loader file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ctfmon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCTF Loader

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ctfmon.exe · signed by Microsoft Windows

0485b01bf15802441fe1671cae60cdf82697b121b8eb21c2d5205ce6aae7ffbe

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ctfmon.exe · signed by Microsoft Windows

30d7f3c7386c36c622f61fbe4eb51e8974f4ab3500c4b83291a19a120ee4fad6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ctfmon.exe · signed by Microsoft Windows

33ad4738b6342c9cc2da01402b26a4424c0adfddde9936d8926a86bf8d80d44f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ctfmon.exe · signed by Microsoft Windows

484fed5f039f429ed933931ba607b7efda7d1a343d79cfab60910e1843147012

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ctfmon.exe · signed by Microsoft Windows

a0df21d82daa60f8181589f4ce96441891b6e13716f353e9d71c8b303cf398d2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ctfmon.exe · signed by Microsoft Windows

ced6ea595e441b17dcac9109031215601728ed04cdada8d9e1893546ac3e1657

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ctfmon.exe · signed by Microsoft Windows

2d88ab60714d7caa53b06653cdd31e14093121cebf3bb7eb7ca0f1b9f04a3a8a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ctfmon.exe · signed by Microsoft Windows

81ca60464f7e079a3f3411968cfea5eade8085a5b96ef46621e07319dc404f1e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ctfmon.exe · signed by Microsoft Windows

103c028f6ed13fdf916b0b15138bdfe66cac0d667d735d853fc8e45341fe8a3a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ctfmon.exe · signed by Microsoft Windows

171abacad96cd027317621fc8fb74aa3b8c13bf25eba79955b0e51bb90c6a843

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ctfmon.exe · not signed

035f9b76f8b5fec3f645a5645257ff7e13d603a878648881affdb0e9dc989bc8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ctfmon.exe · not signed

35fd9608d1147d191d8689ac10e75934ba93dfe54c1432545bc8a10cb20cf72b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ctfmon.exe
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)