CmdID

CmdID / Files

ngentask.exe

Microsoft .NET Framework optimization service file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ngentask.exe?

file version info and known copies
Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
Signed byMicrosoft Windows
ProductMicrosoft .NET Framework, Microsoft Corporation
DescriptionMicrosoft .NET Framework optimization service

6 known copies

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe · signed by Microsoft Windows

150bf8a1ff5e05fe0d3e8190d4f3a96e279eaa25b3e40620febee0f623b71e05

4.8.4341.0 built by: NET48REL1LAST_C · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngentask.exe · signed by Microsoft Windows

999af53de73a2c4f0cdb8d9a19ed29d03827f89aa0f4533bb9c2d54e9b7a2137

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe · signed by Microsoft Corporation

21cfa6bbc96779923e21ca05f14a32ab24cf45eb0c448aa0c4f60b71635924d8

4.8.4320.0 built by: NET48REL1LAST_C · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe · signed by Microsoft Corporation

ff70c1b71440e34931eb8ef97236f3cb2bb2668c72e7a3338660ced5c0753af8

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe · signed by Microsoft Windows

41019bd2dff58eca53a25ffce26e487af0b693c3d305e67a0d4e8f8cd60c6ef6

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe · signed by Microsoft Windows

58920fddca62bc540072ba0eaa17429f9add01985b90768da33c5cd73771e361

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ngentask.exe
lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names ngentask.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.