CmdID

CmdID / Files

Magnify.exe

Microsoft Screen Magnifier file version info

Program on Windows 14 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Magnify.exe?

file version info and known copies
Original nameScreenMagnifier.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Screen Magnifier

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Magnify.exe · signed by Microsoft Windows

62de892f7500d2afd9563b6abd0ef9f6f6e2c152c43466bd40fa12b5fb55d320

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Magnify.exe · signed by Microsoft Windows

66659cb6a0e4ba9ec7581c903d448877b25a7499d576a9d98ec06de110c42afa

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Magnify.exe · signed by Microsoft Windows

24dd719b95f5451bcde90c3a140865be212007bb2c077d08309f6c59f7149cc4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Magnify.exe · signed by Microsoft Windows

57137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Magnify.exe · signed by Microsoft Windows

66b87efbf56e20fbfb0667c3d3cda098b9eca7472c597f381958524d6ede0bac

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Magnify.exe · signed by Microsoft Windows

72187106e9c57d2655adb2ab6176a00267878b5c3c698fe321cef5baa14346e8

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Magnify.exe · signed by Microsoft Windows

e56e7ff8534aba65462fbe7c5331cd327fc59a8f0caa11c2d904008b699b215b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Magnify.exe · signed by Microsoft Windows

360cbaa2ef0f314af6fb364d664a02403a06736b8a301af228c344bef7567274

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Magnify.exe · signed by Microsoft Windows

33fcd1363966ab6478fe5b1061fa5a401bb8bf5c0996a837e1b08ff892393ef1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Magnify.exe · signed by Microsoft Windows

c4c643f6f8bbd577f3d108b8dfd14dd72df32bf96a87c811f60d4240f7ca7306

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Magnify.exe · signed by Microsoft Windows

82ea54bb8c1a96ae09cb240bb14cff8a6a6e612f76fbb0ae39a4a10e2e3cb318

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\Magnify.exe · signed by Microsoft Windows

d21dfa47b574f4398bce74d8cb3a9dc6b8077f32059358809754ee2efcd287c9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Magnify.exe · not signed

df7a3919abe2da4172fdb97d086d81518a2bcd4b030f644f51488f92198c4776

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Magnify.exe · not signed

e2d6eb8764dd4ec3bf840f30a5e911fbae832d54f3c2a6939addd07787c08bf6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Magnify.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro