CmdID

CmdID / Files

quickassist.exe

Quick Assist file version info

Program on Windows 8 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real quickassist.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuick Assist

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\quickassist.exe · signed by Microsoft Windows

3b93a9391c4a945df68dcce87ec6239c0fbc1eb5bf95fce698ef990bc040673c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\quickassist.exe · signed by Microsoft Windows

81414991fcae587b1cc93128354a1643e1be6b166681a8904fdce0f7baa4cdcc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\quickassist.exe · signed by Microsoft Windows

023155542b86dc9e1dedaadc2fca0f5de90153c529508c25c63a7e3b3fba958c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\quickassist.exe · signed by Microsoft Windows

614b6b3090990103ece98b737a1961c9f5c14ffdc86ebd1552b1d86d9a577394

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\quickassist.exe · signed by Microsoft Windows

ae58ceb26c7785fc56a582b351886dd2e02b0b473f49fe312ab7a2560a06f2e5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\quickassist.exe · signed by Microsoft Windows

f3ff9db4c29e460735ffa8e9b0882a27ba5ac67351cd2adea759e496d8ba918a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\quickassist.exe · signed by Microsoft Windows

5a64a20ef47220f4d9f74cc0e695eba855a9895ba4c808e2fd3afe92fba40b4a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\quickassist.exe · signed by Microsoft Windows

c58a2f432b756b9e7044892573658b18ed978c711e2ba960d9bd0f4350602d44

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name quickassist.exe
lowQuickAssist ExecutionMuhammad Faisal (@faisalusuf)

Sigma names quickassist.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.