CmdID

CmdID / Files

user.exe

User file version info

Program on Windows 8 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real user.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUser

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\user.exe · signed by Microsoft Windows

d0c0840941ec828bd0413f70622de1832dc16fc40cbe948cc788d84537ded0f7

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\user.exe · signed by Microsoft Windows

ae62bc1ea069f1e99ee71731a0a37a4c1af4ed221b3f0714238989a92c533a44

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\SysWOW64\user.exe · signed by Microsoft Windows

0c3d8d735e9c63f87d9cb6dee3a8ccf6cb30207c65afb5ef0ed8cc1323b957af

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\user.exe · signed by Microsoft Windows

688ce03731cf6d1221ce7ee0da0522f873e28f4a4b2f7c4919ce363c9441eda4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\user.exe · signed by Microsoft Windows

d761c5548cf82b54b4ac4ab6616d1b6ea9ab547613654aa3c1df78aad4e6918b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\user.exe · signed by Microsoft Windows

4d2b4aa1114b342c4068e77ee063a4687c1d07cc1e51938cadac364df479c5b4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\user.exe · signed by Microsoft Windows

d8d689581e24a07eec1e7b2a06e494b81509fe7c67f982905aae8d3d90f4a567

6.3.9600.17475 (winblue_r5.141028-1500) · C:\windows\SysWOW64\user.exe · not signed

3513c2b2d4f8d55e07f74b3c841b131155212439d3697d8c2865caf93fca3fcb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name user.exe
highLace Tempest Malware Loader ExecutionNasreddine Bencherchali (Nextron Systems)

Sigma names user.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.