CmdID

CmdID / Files

icacls.exe

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command icacls

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real icacls.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\icacls.exe · signed by Microsoft Windows

198bf59689b3cf7f203195eca699ff64f4dd3bb1aed608f0224dcf5f3cf11344

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\icacls.exe · signed by Microsoft Windows

5c2bc204b54f82ce81baea8f5aba60dfbb5c6411eaba8ae10f077ff783e90a05

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\icacls.exe · signed by Microsoft Windows

222ea0e9d8ed1d337dbaedd75a13b8f28fa5c3711dcdf4307e75cede5b5f6b9a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\icacls.exe · signed by Microsoft Windows

468f69606e8f341b8822d20f6557cc1c2be1ba61ffbc47988540c8674f46017b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\icacls.exe · signed by Microsoft Windows

3524ede090fe503a30dec8f629a74b8f720c9a230e5c4e49a3bb151c8ac1424a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\icacls.exe · signed by Microsoft Windows

9715995597d0ab2f3ff7e9a450d4eee3f5b89d44150f8e1493541e18d76c3bb4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\icacls.exe · signed by Microsoft Windows

8dfc26eefc94bd4fa35736444d8d9703aa2d3802d17896835f9ea9de136a68c8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\icacls.exe · signed by Microsoft Windows

ace546697cc29946f459eecc3b0c3035530aa603880b811c7d1b0156ad7eb692

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\icacls.exe · signed by Microsoft Windows

0ca4aff87eed104e2277c0e38b292cd32950dad6a233c791f798ea75ae28deec

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\icacls.exe · signed by Microsoft Windows

a1bd6adb57efd737c0abc1be4d4e732b54afaaed42fc4e077522fa4dc88b5ca6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\icacls.exe · not signed

0dbee1f682db7a4e279261a3e24acbb5cfa789196b85ccde54a32b04b0465f63

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\icacls.exe · not signed

55f6d2483307499de4bd0fe81359b648734c905e3ef02dac2ff04b0a1331ce6d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name icacls.exe
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumUse Icacls to Hide File to Everyonefrack113