CmdID

CmdID / Files

driverquery.exe

Queries the drivers on a system file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command driverquery

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real driverquery.exe?

file version info and known copies
Original namedrvqry.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQueries the drivers on a system

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\driverquery.exe · signed by Microsoft Windows

31c7953efda0f9f4853fe345edbc0e402b609f3a781a09a164c3e74b15d5a799

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\driverquery.exe · signed by Microsoft Windows

6cb57182340b1406c454731c6868db9b5849e3972e38a4eb23503e38a73ec0ef

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\driverquery.exe · signed by Microsoft Windows

42ec0718e29088ea73bbac9c96eaf02807ba556a392fa8c830ae9b425b7e0cc0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\driverquery.exe · signed by Microsoft Windows

6696bf1b9d15f90031dcdbf5f227c137ce9a85f5459bdc2d9b906d93b216e055

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\driverquery.exe · signed by Microsoft Windows

0d0b565f8aeb0ed951320b790ab5ee120ac485c1f502757c5e3f9c337a83be57

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\driverquery.exe · signed by Microsoft Windows

a743accacb3ed1b0b0e9d941f6c8bdeb7e36b9a65004630788adb64c92777a2a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\driverquery.exe · signed by Microsoft Windows

4cb5b035e0f4e62350f91366bf16ca816bec39aeda4f11dff44b01525ddbe272

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\driverquery.exe · signed by Microsoft Windows

54bd0e8075f63285c1408516913abd9913ba058a80a43e345ad42b34f36f6c12

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\driverquery.exe · signed by Microsoft Windows

8034e5dfbd3e66212ff59916536826ed259ceb9f9d85c3df3dd01037b4619641

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\driverquery.exe · signed by Microsoft Windows

c201d26820b30bdca8fcdba7f043ef5a191f6fa1ff8a82f7a56ea6fe449ba4c7

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\driverquery.exe · not signed

0b9af0395fe2e9f5acfca6945f9f678fa4453f179e6a0e7dc32a259120366a01

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\driverquery.exe · not signed

a07c4d3b4970e4041201b62daa296ebe8eeae6a940b40c0a545eb6215d13eace

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name driverquery.exe
highPotential Recon Activity Using DriverQuery.EXENasreddine Bencherchali (Nextron Systems)
mediumDriverQuery.EXE ExecutionNasreddine Bencherchali (Nextron Systems)