CmdID

CmdID / Files

provtool.exe

Provisioning package runtime processing tool file version info

Program on Windows 5 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real provtool.exe?

file version info and known copies
Original nameprovtool in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionProvisioning package runtime processing tool

5 known copies

10.0.22000.65 (WinBuild.160101.0800) · C:\WINDOWS\system32\provtool.exe · signed by Microsoft Windows

e588c074e63ff29db81e5e1730414c34482f3dd49beeb9e0bbd2cf6e82bd2b0a

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\system32\provtool.exe · signed by Microsoft Windows

e0d2c66cc92a80c77ab29a56641505036130a8b01bcbafb866e28729f4985e4a

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\provtool.exe · signed by Microsoft Windows

f643689f807c0666ec44e9d9b3bd583f1254049dddad0758235ee5c027352cfe

10.0.19041.153 (WinBuild.160101.0800) · C:\Windows\system32\provtool.exe · signed by Microsoft Windows

cffb7b74ee1f49c6c27b5ce5b72cd3d3ba455b98961de6c3ade9bb7a584a3be2

10.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\system32\provtool.exe · signed by Microsoft Windows

c4035d083053f59f6ecdbc8c804463d038f9cf7730d680b3693780d14b44a42f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names provtool.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.