CmdID

CmdID / Files

scrcons.exe

WMI Standard Event Consumer - scripting file version info

Program on Windows 6 known copies with hashes 13 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real scrcons.exe?

file version info and known copies
Original nameScrCons in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Standard Event Consumer - scripting

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\scrcons.exe · signed by Microsoft Windows

30ad459b1aa86df2d32973b4a36fae66e3f8f1e6cfa3b99a422dda041e5c1082

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\scrcons.exe · signed by Microsoft Windows

f96c187199362265fac87adb337db242d24f9b313407646f89da62a1ed12b6d9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\scrcons.exe · signed by Microsoft Windows

6c02d54afe705d7df7db7ee94d92afdefb2fb91f9d1805c970126a096df52786

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\scrcons.exe · signed by Microsoft Windows

2c91f17dd33e78430451d47f2e26715eb6e1fd8125e530182ec0caceb4cd755f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wbem\scrcons.exe · signed by Microsoft Windows

7154b0624717dfe981520581e31ad7e53f3d77ba9edceed88be397aa5e4e9b19

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wbem\scrcons.exe · not signed

7d0ba1a011ec2c2c392a86d1c5ebaf20f5615142ed3de4ed5cd603f60e520345

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name scrcons.exe
highScript Event Consumer Spawning ProcessSittikorn S
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton
mediumWMI Persistence - Script Event ConsumerThomas Patzke

Sigma names scrcons.exe in 13 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.