CmdID

CmdID / Files

VSSVC.exe

Microsoft Volume Shadow Copy Service file version info

Program on Windows 7 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real VSSVC.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Volume Shadow Copy Service

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\VSSVC.exe · signed by Microsoft Windows

5185ef79c627a10b72b5c37728410c223d648cb20e9cfa47677f7e97062fcaf2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\VSSVC.exe · signed by Microsoft Windows

0ba31f101507cd279108f7845aa7ef38b7adc2e595921f6a1c09954a2315409d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\VSSVC.exe · signed by Microsoft Windows

c354ebf05cfbb95aaf954038e237d184f9cb2787859b063c9161b57393d90fd0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\VSSVC.exe · signed by Microsoft Windows

c4a4bb9b050d214d44119d6f39822e9e3b36ef7da67471843c0856e090987b70

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\VSSVC.exe · signed by Microsoft Windows

8a2e257efe4e583b6379e91009de252fa64f2a43f134b7fc1560cc3e8fbf3688

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\VSSVC.exe · signed by Microsoft Windows

6e967cbe87f41f1d5d102dffad46f13129e1b0fc7fd3920f3ce92e45e978e929

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\VSSVC.exe · not signed

7fcbbcaf1aa85dce8d75fb38dc4848ae12e8dd913cebbc37bcd3d0123f0a3cab

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names VSSVC.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.