CmdID

CmdID / Files

MDMAppInstaller.exe

MDM App Installer file version info

Program on Windows 7 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MDMAppInstaller.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMDM App Installer

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MDMAppInstaller.exe · signed by Microsoft Windows

7df8274cc0656683a8b977a3ee73a2bbc7554a4ce11ab89898e08d9311a2b3f8

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\system32\MDMAppInstaller.exe · signed by Microsoft Windows

dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\MDMAppInstaller.exe · signed by Microsoft Windows

79b9d43aacd693ebdf53e6f90b3c6eef5ee4ee2e80d229518aab98ac48c1c65e

10.0.19041.153 (WinBuild.160101.0800) · C:\Windows\system32\MDMAppInstaller.exe · signed by Microsoft Windows

e1119cd9b4635bf1d33d091984000002d282682166f098cda0a36d6ffcd8d356

10.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\system32\MDMAppInstaller.exe · signed by Microsoft Windows

b0425e8a78f57a00fe66459f57ccd2536ed5bba20149efd8df12082096fb1cb9

10.0.17763.1098 (WinBuild.160101.0800) · C:\Windows\system32\MDMAppInstaller.exe · signed by Microsoft Windows

dc8085816dd0fcd8fb2ab8da264ed65cf264387edebfbb7221e80aa68f4785ee

10.0.14393.351 (rs1_release_inmarket.161014-1755) · C:\Windows\system32\MDMAppInstaller.exe · signed by Microsoft Windows

5891abbac0e2db865f9422881b2f861f3c226e4a0470e5596a95170e3cdbe3df

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names MDMAppInstaller.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.