CmdID

CmdID / Files

takeown.exe

Takes ownership of a file file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command takeown

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real takeown.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTakes ownership of a file

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\takeown.exe · signed by Microsoft Windows

6a4834f2b4caa98e3885ce758c675008768f48a51e87cbec5ddefbb8b9e73c04

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\takeown.exe · signed by Microsoft Windows

9ce1d32186f041b669d3ca1afb12dc5f6f7c1ea93267de38c2fd5aa18a04fb0a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\takeown.exe · signed by Microsoft Windows

57b3cfa9993e52866a2fb489edf079bf4f1c78fa7525bdf59affa8f9cb4023f8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\takeown.exe · signed by Microsoft Windows

c7159144c6403c38aaf3def4c2fc5759b6df824af003b304d4b77c6d72353b3e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\takeown.exe · signed by Microsoft Windows

90d519a81f59590742362461a730a67fa032806fcc53ee387b840ff04d056791

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\takeown.exe · signed by Microsoft Windows

a6780dc8d060dc4c629efbe5ffe4b545e5476a80017d86b7a79bc5ccc1de47ad

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\takeown.exe · signed by Microsoft Windows

5c865d2d1012ebf9f2503f06f2c4b8afccae063d1e79421e0244e0cf627e5ff1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\takeown.exe · signed by Microsoft Windows

820bf585a941580590caaa0b4ad767ca7ec91549006dd949ccde9e550398b9c1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\takeown.exe · signed by Microsoft Windows

7c450a381842bd8d526bf29780b2bf953d748801435ff402ae89927837f2d32d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\takeown.exe · signed by Microsoft Windows

dfabefdba0976dac4552238da3e0ee15eae604a813b78b2105f9c5ef1662cbd1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\takeown.exe · not signed

26b3dd8e0fd18190144ef1ddb2ed08affeab2bcd1a218e091db5671010af4af7

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\takeown.exe · not signed

f844a4a3e020fe064218d65a0f26b2db28a3d92ff10077fde023454d3adc8510

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name takeown.exe
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumSuspicious Recursive Takeownfrack113