CmdID / Files

wabmig.exe

Microsoft (R) Contacts Import Tool file version info

Program on Windows 2 known copies with hashes 3 Sigma rules name it

Is it the real wabmig.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Mail\
C:\Program Files\Windows Mail\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft (R) Contacts Import Tool

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Windows Mail\wabmig.exe · signed by Microsoft Windows

89500235e2416b8931f749e87e591b2661a3b31eb607cb654f89b5c0b84277b6

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Mail\wabmig.exe · signed by Microsoft Windows

f6b817340614d938ccec6c301aef530e5d5c5f8742fcd747c6fe815a9ecdafa6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wabmig.exe

highWab Execution From Non Default LocationNasreddine Bencherchali (Nextron Systems)

highWab/Wabmig Unusual Parent Or Child ProcessesNasreddine Bencherchali (Nextron Systems)

Sigma names wabmig.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.