CmdID

CmdID / Files

RuntimeBroker.exe

Runtime Broker file version info

Program on Windows 8 known copies with hashes 10 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RuntimeBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRuntime Broker

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RuntimeBroker.exe · signed by Microsoft Windows

032233b9effcaf9a5446687ff76885ce2f69c89a277fd3bef36c3abe763f29e9

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

e86870769ee6c797e09457bd99c58d9bf2303cf0193a24ef9b1222c2c3daf628

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

70d968b4f65c5ce471474096f8623aecd7d496e4f10c8b94c3577c8362e0ada1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

154316c8e1fe282655a3df44f5af3b0c5f0ecc37449eff4b3ead44fb7414d468

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RuntimeBroker.exe · signed by Microsoft Windows

5e979c34a5feb14ed18f36e956b0614ff305c8596dd01571a2ebabdc8131ce77

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

e00345a3df0ee01edbd9c14e39ea8c8d5fa0a7d09de8141155333391f8aaa453

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

20a7eb74efd23933a5c0887d3d8ce66fea009a6cd257508cb4b0eb70f8d27c57

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\RuntimeBroker.exe · signed by Microsoft Windows

c52bee78658c897ab70714ee4600a4fd509c7362f4dddfd1fc643ff52d6ba314

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name RuntimeBroker.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumVerclsid.exe Runs COM ObjectVictor Sergeev, oscd.community

Sigma names RuntimeBroker.exe in 10 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.