CmdID

CmdID / Files

sysprep.exe

System Preparation Tool file version info

Program on Windows 10 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sysprep.exe?

file version info and known copies
Installed inC:\Windows\system32\Sysprep\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Preparation Tool

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

c12408b6fd84cd48cf9b940edbe145ae9230afedb54a9288b34dd6836d0b2bab

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

13d75313a9c011214f7c62ef659e441abe4c80d5f85ff559c0abcfdb36c44f10

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

3588bfebe1d297ee8c240a27413699a1e845436535cdd654a1b7b9d7a96b6d72

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

5e65918023add10e63533950f9914bfc09f5eaf46d28ccc73cce833b1725a498

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

c723d7dcb559386d16be57498185fcf17ff8f68ff952f4add84cef6ecb58d672

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

a03a0d2c47163ee59eccff492bfa40367473b907065eedcfc36eb5d94d9f78ae

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

71ef84a9a310e34483ce3d40d805743f2d59de1d3adad3f1639a6cfdaae08efd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

f5cfd1631d2dfe7c2e4bac631374cc793179c1d3757801b4bca9c77e9a3fcfbb

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Sysprep\sysprep.exe · signed by Microsoft Windows

b63d4e3aa65ee9d70a88c21e4ffb0476c0dcd1bd058e0dd44f8202aff4d543b5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Sysprep\sysprep.exe · not signed

651e0b5e530e8058d27b7784f89c7839476c5342b0ae3abf85981b6c2d0f4080

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sysprep.exe
mediumSysprep on AppData FolderFlorian Roth (Nextron Systems)

Sigma names sysprep.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.