CmdID

CmdID / Files

iissetup.exe

IIS Setup file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real iissetup.exe?

file version info and known copies
Installed inC:\Windows\system32\inetsrv\
C:\Windows\SysWOW64\inetsrv\
Signed byMicrosoft Windows
ProductInternet Information Services, Microsoft Corporation
DescriptionIIS Setup

6 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\inetsrv\iissetup.exe · signed by Microsoft Windows

7b57e0675485a1f1d860f61cc60003b195ffbe6c69cdad496a74b2206791e125

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\inetsrv\iissetup.exe · signed by Microsoft Windows

809730aa4b0a2b577a1ddb0cb57dd2ff27508cc82cdd738dac2ef0ce49443b58

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\inetsrv\iissetup.exe · signed by Microsoft Windows

716a904d938344e94908cc7e7a3a02936cb8140ae8e722fb9af6c691aec43eec

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\inetsrv\iissetup.exe · signed by Microsoft Windows

80c1844eea2d654f640db4449c5fab0af2b1115bd98dfa62e5676f897234d144

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\inetsrv\iissetup.exe · not signed

dbd6048833df804524633ead2b73f216e717ad74d082ff436349f69200ad11fa

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\inetsrv\iissetup.exe · not signed

f69c31d174ad0955faaa1cafabbd8cffce8a051db2e4cddf3de205f35ac6a2b9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name iissetup.exe
mediumIIS Native-Code Module Command Line InstallationFlorian Roth (Nextron Systems)

Sigma names iissetup.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.