CmdID

CmdID / Files

Defrag.exe

Disk Defragmenter Module file version info

Program on Windows 7 known copies with hashes 2 Sigma rules name it Command defrag

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Defrag.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductWindows Drive Optimizer, Microsoft Corp.
DescriptionDisk Defragmenter Module

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Defrag.exe · signed by Microsoft Windows

6bb17aa5a647d4526957bf35f596e13cb5d0595fee71e4f64a20d965c67b5e5f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Defrag.exe · signed by Microsoft Windows

7a18dbbe6ca138389424a7b2c0135ba4a7541c33e0443227f3cf505b58b52a85

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Defrag.exe · signed by Microsoft Windows

d90df37806e6f4a59d51b2d6fedfdaf129436c4a0bc27dc271650b53b4848053

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Defrag.exe · signed by Microsoft Windows

2630901b1b24ede6aa117163bb738b90921d3d67f5aeb233cac0715a836bace3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Defrag.exe · signed by Microsoft Windows

e97f31c6a63c8fe8176892da0d993b6d7dc9fe8850c91f1fa95c7fcb0177ad65

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Defrag.exe · signed by Microsoft Windows

9fec67b7e7c6fb7009c5d16387b1b34c017ea0bbe7543c63a2e197b1f369f127

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Defrag.exe · not signed

e12f5a5804519a4c8f4eda5b27b3477d89aa4b80e5d9bfa359c1d6794d947965

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Defrag.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names Defrag.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.