CmdID

CmdID / Files

whoami.exe

whoami - displays logged on user information file version info

Program on Windows 12 known copies with hashes 21 Sigma rules name it Command whoami

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real whoami.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionwhoami - displays logged on user information

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\whoami.exe · signed by Microsoft Windows

0defec618334e071f9e97ee2d1f7d0e9bb3e7f22a19ff078d7cbef5845de5179

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\whoami.exe · signed by Microsoft Windows

9156e5eb17d18da8442124fb4034da2d0baa3d4499edcfe265b34299c33a6eac

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\whoami.exe · signed by Microsoft Windows

1d4902a04d99e8ccbfe7085e63155955fee397449d386453f6c452ae407b8743

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\whoami.exe · signed by Microsoft Windows

91d257ec8800204642d96d2a0fb87937529c36debd5c3ad4380f79acc91b62cf

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\whoami.exe · signed by Microsoft Windows

a8a4c4719113b071bb50d67f6e12c188b92c70eeafdfcd6f5da69b6aaa99a7fd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\whoami.exe · signed by Microsoft Windows

aa1583d770c6774f8d8fcec099cf7bdc05beb0f08f6db387f5b37cca860771d7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\whoami.exe · signed by Microsoft Windows

075fa41e449213910f6d45f5713fef8ed71ea913c1ebe594407894141f103d64

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\whoami.exe · signed by Microsoft Windows

1d5491e3c468ee4b4ef6edff4bbc7d06ee83180f6f0b1576763ea2efe049493a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\whoami.exe · signed by Microsoft Windows

72c2b9733d3d143cb23ba5d6f3d5b690d39ed458b6c430557ff7b50fe6c3f28f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\whoami.exe · signed by Microsoft Windows

8ecffcce38d4ee87abaee6cbe843d94d4f8fb98fab3c356c7f6b70e60b10f88a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\whoami.exe · not signed

16c4cee8c7bf4070e25a32f0b95857fa5cec51e47d246e6fbad69887460961b2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\whoami.exe · not signed

4e62c0e369b1eb045548d9c9bb2ba27137e6456d12f5c97f61bcd5890239fe1d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name whoami.exe
criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
criticalRenamed Whoami ExecutionFlorian Roth (Nextron Systems)
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io)
highPotential Process Injection Via Msra.EXEAlexander McDonald
highSecurity Privileges Enumeration Via Whoami.EXEFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWhoami.EXE Execution From Privileged ProcessFlorian Roth (Nextron Systems), Teymur Kheirkhabarov
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumEnumerate All Information With Whoami.EXEFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumGroup Membership Reconnaissance Via Whoami.EXENasreddine Bencherchali (Nextron Systems)
mediumSuspicious Electron Application Child ProcessesNasreddine Bencherchali (Nextron Systems)
mediumWhoami.EXE Execution AnomalyFlorian Roth (Nextron Systems)
mediumWhoami.EXE Execution With Output OptionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community