CmdID

CmdID / Files

w32tm.exe

Windows Time Service Diagnostic Tool file version info

Program on Windows 14 known copies with hashes 3 Sigma rules name it Command w32tm

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real w32tm.exe?

file version info and known copies
Original namew32time.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Time Service Diagnostic Tool

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\w32tm.exe · signed by Microsoft Windows

3961d423ca02fae486d3cbdcbda083bf6d851f93c5415b91a2653cc0f8c0aacd

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\w32tm.exe · signed by Microsoft Windows

8ed11d917168922e779fbb1062d757e8641d4251cd94cd52c474ae17ac6e1c17

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\w32tm.exe · signed by Microsoft Windows

88f14176c848adce732fe1db67c2d95cd495ac71caed5d137e0108332509042f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\w32tm.exe · signed by Microsoft Windows

8ab5c40895d73907b4f96ba73e73c5bf12a76a00965034a4146f85533b14f5c4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\w32tm.exe · signed by Microsoft Windows

61009645625a99e7c2b2dcef4f77f7ff3c8894d43d4d9a856082e14c1a52780f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\w32tm.exe · signed by Microsoft Windows

67fb8c44c4e05b9b090bf839b1abfd389de633f4a987141bd705e173927eb48f

10.0.17763.719 (WinBuild.160101.0800) · C:\Windows\SysWOW64\w32tm.exe · signed by Microsoft Windows

b98bde1672d51b66cdaef87936826773cb8637e34b5f63b9f1e10b0481ce3da8

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\w32tm.exe · signed by Microsoft Windows

52537a069c700f82683549dba51bc73b66130385d726497c1728dc5a0b80987d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\w32tm.exe · signed by Microsoft Windows

a6068fdd06a779798be73420ae7e91544c23b96eb01d75a1be86ead8c0413e6b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\w32tm.exe · signed by Microsoft Windows

c71b4316bf6ebd40a227e0fa3af899a00375c41d5029f55eb5880d6fb0a6a5f5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\w32tm.exe · signed by Microsoft Windows

6b71a1db48da5f0359ea3fbbd3dec449b7f91b00687617d0d6e979b5f0ab2459

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\w32tm.exe · signed by Microsoft Windows

c879ce7de155ada43e5bfc5bacecd54529c8019b90f8be09ffa116a118be92d5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\w32tm.exe · not signed

15e9ef8fe24a1ce0ad23911b6ea10d3e56c8586ad310da7b994958f64eac92c1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\w32tm.exe · not signed

21fff3acf14af70e22d23028dc26bee58c8394707c61618ae1d35866dc9c4d51

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name w32tm.exe
highUse of W32tm as Timerfrack113
lowDiscovery of a System TimeE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

Sigma names w32tm.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.