CmdID

CmdID / Files

wininit.exe

Windows Start-Up Application file version info

Program on Windows 9 known copies with hashes 9 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wininit.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Start-Up Application

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wininit.exe · signed by Microsoft Windows

f118a260b679960d7fd27eb3f3b718ac5482912ea43d16ac06f52f563c386830

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

24a0e0ace66aeb97d101df232a571368c4068d9b46b9d3e9c22f8c10d0be7dc4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

268ca325c8f12e68b6728ff24d6536030aab6e05603d0179033b1e51d8476d86

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

69eec502a5423f3e947465d3eaf8d1df9ccb8477a27c361be314e21671d71205

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

d2b87ea160882698ca6ac6fcf3d5739b41c14794428f6c00639417bc76af5610

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wininit.exe · signed by Microsoft Windows

d5e122606054fa0b03db3ee8cf9ea7701e523875e2bdb87581ad7232ffc9308e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

13ad43ee6d19dfc9709c3106d796bc3f21791a564e443d042a5aa117f2680649

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wininit.exe · signed by Microsoft Windows

8694c5732d26921eea29589a9fa4182139ef3d9ea6b6d0acca8994b4aa5defe5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wininit.exe · not signed

a283a3000e631e281ec3b9f2a029faaf76aaf267bb8b1921fb2b9b0b51c87d19

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wininit.exe
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highTerminal Service Process SpawnFlorian Roth (Nextron Systems)
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names wininit.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.