CmdID

CmdID / Files

systeminfo.exe

Displays system information file version info

Program on Windows 12 known copies with hashes 12 Sigma rules name it Command systeminfo

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real systeminfo.exe?

file version info and known copies
Original namesysinfo.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDisplays system information

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\systeminfo.exe · signed by Microsoft Windows

104e036a6dae7a24e70e9edf489702a33d67031cc09ed8265854a221764d8ee3

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\systeminfo.exe · signed by Microsoft Windows

42e470c55b6d36e1366a0568c9ef20aa8bc6c1ee4d2c9a4e5a4a6c09d54b1eb6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\systeminfo.exe · signed by Microsoft Windows

6f87caa51bdea802045bb281fc2686a3c76364c26a3ffe6c2ccac4af5f9db37b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\systeminfo.exe · signed by Microsoft Windows

f1e43f167059ff746e200b21ddc55326cd8b3acd7d6bd9c541230db6f8bc63d1

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\systeminfo.exe · signed by Microsoft Windows

9bc249377a01fb43cdf969f3aa673619a941dad3bc07aa07e73df5908cfbbf60

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\systeminfo.exe · signed by Microsoft Windows

f5b4fb293ada97a8c4b92bb380747da1d71336f144332c95ddef3f8522f7ce87

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\systeminfo.exe · signed by Microsoft Windows

1084adf2ddbe903bd71a496720b0d6616882f120d1b3ffeae8d47feb0d9cc123

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\systeminfo.exe · signed by Microsoft Windows

81e6d6cb7a0f50f5bc331fd2af48a90f2dcee9ff7ef4f1abe0b87866f7837985

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\systeminfo.exe · signed by Microsoft Windows

531794d32301b83bdc58d09a2aa3a37f4ffe46107bd796187caf3cd132d1b755

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\systeminfo.exe · signed by Microsoft Windows

c1c3436b2d55d7f7d75b9620a9fd0a911cd8573c67115aebf25f474a69e61862

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\systeminfo.exe · not signed

03d2ef40e7c019a526b1aec22b273f1c4d407973df7f8bd5028c31ccaca9a492

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\systeminfo.exe · not signed

31368d980d418dbfd72d4e3331614bdc8ba215159a42b437349e239280c9a91d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name systeminfo.exe
highExecution via stordiag.exeAustin Songer (@austinsonger)
highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
lowSuspicious Execution of Systeminfofrack113

Sigma names systeminfo.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.