CmdID

CmdID / Files

shutdown.exe

Windows Shutdown and Annotation Tool file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command shutdown

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real shutdown.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Shutdown and Annotation Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\shutdown.exe · signed by Microsoft Windows

0967219df10097b8de71e459cddbadc2307d76bb95f03adefdb57149392cfe1d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\shutdown.exe · signed by Microsoft Windows

dfe38498f2cd03274b38bc3992f8b5502a4e53ab58bae82088d473b6888f601f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\shutdown.exe · signed by Microsoft Windows

d4e68cc9cb1965d70134c68bd1a090e0afae5b8b3d8018c6b6564852ae7bf396

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\shutdown.exe · signed by Microsoft Windows

dbdc6188128b32e6e3d99cd0b136ff0f0ea6cdfa2d3c748f342c5697e7bf4c58

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\shutdown.exe · signed by Microsoft Windows

191b43f2f69c998131409d533bdc306c287d1ef83ef0cd74616b65a498c2fecd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\shutdown.exe · signed by Microsoft Windows

50fea3072501482163d07fecebcea989fa9e1cb3f8e2cc34c352bd5cf2982963

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\shutdown.exe · signed by Microsoft Windows

6219c1bc22930d17997dd21dec663705aba0b01fed1d11f73b6a9c721f894cb5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\shutdown.exe · signed by Microsoft Windows

6d262b3cbedac276c3eb960df923167fe0449218721334dcc48a561e981b5790

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\shutdown.exe · signed by Microsoft Windows

c85c8670663b6cd40d3a90179419caf5d0c340993177cd748b58d72e034b4f02

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\shutdown.exe · signed by Microsoft Windows

f96073c3442ea0a99b4945394007602772db36732d1511dc2068519526678f8a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\shutdown.exe · not signed

08eef39a50bbc70e4257caea1df39bcfe2cf3ef725a54c3bfa01da3a9046ecee

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\shutdown.exe · not signed

7c8e3dbc64bcb84d6b58dbb0a633b6b0f0bcf6746eacedd93abe2c9c41e80318

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name shutdown.exe
mediumSuspicious Execution of Shutdownfrack113
mediumSuspicious Execution of Shutdown to Log Outfrack113