OneDriveSetup.exe

Microsoft OneDrive (32 bit) Setup file version info

Program on Windows 5 known copies with hashes 4 Sigma rules name it

Is it the real OneDriveSetup.exe?

file version info and known copies

Installed inC:\Windows\SysWOW64\
C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\
C:\Users\user\AppData\Local\Microsoft\OneDrive\21.220.1024.0001\

Signed byMicrosoft Windows

ProductMicrosoft OneDrive, Microsoft Corporation

DescriptionMicrosoft OneDrive (32 bit) Setup

5 known copies

21.220.1024.0001 · C:\Users\user\AppData\Local\Microsoft\OneDrive\21.220.1024.0001\OneDriveSetup.exe · signed by Microsoft Corporation

4cbb680e01757c1dbecd1cca6b7c31cd135b2a3d56fc4be3ff3293865c602d5e

21.050.0310.0001 · C:\WINDOWS\SysWOW64\OneDriveSetup.exe · signed by Microsoft Windows

fd161df816bec886b20d13a0cbba4469eb8e5090e050c5d03fa86e18ad15d917

19.043.0304.0013 · C:\Windows\SysWOW64\OneDriveSetup.exe · signed by Microsoft Windows

94273ec2daed031adb6a954e5e49b29e61042d26bfbe074af534ea743f54460c

19.002.0107.0005 · C:\WINDOWS\SysWOW64\OneDriveSetup.exe · signed by Microsoft Windows

9b1d2d09d162a0b6558828017e47a06357ba1b19fe1b0f746934692d69976cc6

18.151.0729.0013 · C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe · signed by Microsoft Corporation

17a5f35c30b9d1dbb651686407dbf7d1bdcc685426581af6796b364550e7fe70

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name OneDriveSetup.exe

lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names OneDriveSetup.exe in 4 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.