CmdID

CmdID / Files

VaultCmd.exe

Vault cmdline Program file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real VaultCmd.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionVault cmdline Program

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\VaultCmd.exe · signed by Microsoft Windows

c3c92a650456d0034cff5d514572eb282f419bf739652e04c3428797d0e2c84e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\VaultCmd.exe · signed by Microsoft Windows

edc1b6a3e4fde216a323329e35f4192b0f49bc68285ee67036deff9e94c4e33a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\VaultCmd.exe · signed by Microsoft Windows

62cf87143d183e704af6c6eb1a73eda8d9f36497a71bfdd812f232cf01b553d6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\VaultCmd.exe · signed by Microsoft Windows

9e68fcf6fd1104bbd1ca47bb36347abc621329924f880b75793638af04dc607e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\VaultCmd.exe · signed by Microsoft Windows

52be7172716abbc00f6190d27c24fac24e6a871e4e6bfea608e50d254737fc59

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\VaultCmd.exe · not signed

15667792199cc764a62e3e61f5380b08298a107b12c7c3d8109d8edbbc11cc7b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name VaultCmd.exe
mediumWindows Credential Manager Access via VaultCmdfrack113