CmdID

CmdID / Files

msra.exe

Windows Remote Assistance file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real msra.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Remote Assistance

8 known copies

10.0.22000.71 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msra.exe · signed by Microsoft Windows

344a1774933a607e7a00c94196f19d6e11c7f08595b75e801c31c4e2f8e76540

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msra.exe · signed by Microsoft Windows

5ad43163063b6caa94102c480f3738848565e72898c021968ec29d53ae133df6

10.0.19041.1110 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msra.exe · signed by Microsoft Windows

d15d547a3496907c8b5128f7d9219bc2e043b5c476d6c34b84c9280159280f93

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msra.exe · signed by Microsoft Windows

011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msra.exe · signed by Microsoft Windows

a9f3b092c6204f05311174628076e0cf719fe1d3a83af43eb2fb60144e988965

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msra.exe · signed by Microsoft Windows

b2a4d4c2f7af63557426e2aae5ce287311ca1ad229398a095224c9f1a9a6999c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msra.exe · signed by Microsoft Windows

8cd0173fe7b30d989f07c4deb69ec2024e40812f97bc1d670abd11c116a52e00

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msra.exe · signed by Microsoft Windows

c05f25aafae029b9e0fee2316e228bc4391f16d278c8119804e97649d8ade106

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name msra.exe
highPotential Process Injection Via Msra.EXEAlexander McDonald