CmdID

CmdID / Files

userinit.exe

Userinit Logon Application file version info

Program on Windows 12 known copies with hashes 7 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real userinit.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUserinit Logon Application

12 known copies

10.0.22000.37 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\userinit.exe · signed by Microsoft Windows

ea5cc91d930781dbe0f0f9ab83008a4d2ef62fa937376d2191ce893afd9c9300

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\userinit.exe · signed by Microsoft Windows

fe22ddddc30c73aa54a7ea96006b14743a864be9a987ff3b2deb6b9141c2146a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\userinit.exe · signed by Microsoft Windows

28c7d92ea3f248d2b13165e934e25c64f9d61cd2e5d293457ee62b345556a411

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\userinit.exe · signed by Microsoft Windows

eda7ee39d4db8142a1e0788e205e80ae798035d60273e74981e09e98c8d0e740

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\userinit.exe · signed by Microsoft Windows

7065057320320c99d0749f1dedcbea2e5b540404497244eb5f92ded38646f21d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\userinit.exe · signed by Microsoft Windows

af1519bec6adbe3815d082002803fd0570058c324a51f5be15194a058ff03275

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\userinit.exe · signed by Microsoft Windows

1fe7f7c59ec7eaa276739fa85f7dda6136d81184e0aeb385b6ac9feaaa8c4394

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\userinit.exe · signed by Microsoft Windows

6f1c2fd98615b9b0427abb5af0def53e3205b4a9e5eec008e2284e28e839b096

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\userinit.exe · signed by Microsoft Windows

62cfcd13a485aae19eb020fc6d78e7695873f009ca1c5ef2797d9e363a5600e5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\userinit.exe · signed by Microsoft Windows

cfc6a18fc8fe7447ecd491345a32f0f10208f114b70a0e9d1cd72f6070d5b36f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\userinit.exe · not signed

016b8f2067d9a18b5d14f33c8ed98d61ea7c63fd53af5b25b117e2e982e5b780

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\userinit.exe · not signed

0d392968ded34d674409a7a79ff6981990fa732a9e67a767cbedc4c98a0d7cbe

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name userinit.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highUncommon Userinit Child ProcessTom Ueltschi (@c_APT_ure), Tim Shelton
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
mediumSuspicious Userinit Child ProcessFlorian Roth (Nextron Systems), Samir Bousseaden (idea)

Sigma names userinit.exe in 7 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.