CmdID

CmdID / Files

osk.exe

Accessibility On-Screen Keyboard file version info

Program on Windows 8 known copies with hashes 6 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real osk.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAccessibility On-Screen Keyboard

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\osk.exe · signed by Microsoft Windows

fd323d368264f51ac8a762c6a164de8e780bf4ccf28c98f938139fe13530d21d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\osk.exe · signed by Microsoft Windows

f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\osk.exe · signed by Microsoft Windows

53809b7dddb65ce004076b282a039ca682f68cd3211a48237a71c2ccb0dc7003

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\osk.exe · signed by Microsoft Windows

79c62bde821fbb73ccd72621e4eddff3d5dae7b915bb7620084fa72e324b3cc0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\osk.exe · signed by Microsoft Windows

21e04c0248be53d40c091619dbe3b7337e8b26d2e37debb5e8e0489d3d72b423

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\osk.exe · signed by Microsoft Windows

5d26ba9f19deb94a36730cdebc8282ef0a29fb27d1746a0184a833bb053ce3dd

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\osk.exe · not signed

556fb4023100c734b18bd59eff82087922defc89845bc20f285ad2def7611bab

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\osk.exe · not signed

c7e22b9bf45ae6578810914ad912cab77d3f3c5ee0b716e48028c124e1233f73

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name osk.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highPotential Privilege Escalation Using Symlink Between Osk and Cmdfrack113
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
highUAC Bypass Using Windows Media Player - ProcessChristian Burkard (Nextron Systems)

Sigma names osk.exe in 6 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.