CmdID

CmdID / Files

ieinstal.exe

Internet Explorer Add-on Installer file version info

Program on Windows 4 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ieinstal.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Internet Explorer\
C:\Program Files\internet explorer\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionInternet Explorer Add-on Installer

4 known copies

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\ieinstal.exe · signed by Microsoft Windows

a71004c20abc2216d52137a41b72703841da8bab3a97a60eedf77a37e951609f

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files\Internet Explorer\ieinstal.exe · signed by Microsoft Windows

cc57d54c0d17f5e786a75bc28ce2133499672fe378b6f62c8117f2f0c191e932

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files\internet explorer\ieinstal.exe · signed by Microsoft Windows

a57b027f6619281b920503c26a30fa3daefc874be3fc31257f63106f7a434643

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\ieinstal.exe · signed by Microsoft Windows

ad5dcbe9f92c6da4ca09226c93b570f918014d7fb596a7ae402459ab32ea3658

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ieinstal.exe
highUAC Bypass Using IEInstal - ProcessChristian Burkard (Nextron Systems)

Sigma names ieinstal.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.