CmdID

CmdID / Files

wintrust.dll

Microsoft Trust Verification APIs file version info

Library on Windows 7 known copies with hashes 1 Sigma rule names it

Is it the real wintrust.dll?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\App Certification Kit\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Trust Verification APIs

7 known copies

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wintrust.dll · signed by Microsoft Windows

2640c5c44a74f92ce9b49057b0bf13753531d2f1e34019e138fbcb305bc4722e

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\wintrust.dll · signed by Microsoft Windows

b3637ce06c96e121bab826174d8a795ae52379a3259c63f637d0666b70f030f6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\wintrust.dll · signed by Microsoft Windows Kits Publisher

157fe095caee3d3048bd5a584f76fa6fde2d44180d2a4e7a9fa5f402849f3c02

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\wintrust.dll · signed by Microsoft Corporation

5f763147e9d11cbce01cc34f6995a2ff4ffcf565296c1fe6f83d532563fef0ff

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\wintrust.dll · signed by Microsoft Windows Kits Publisher

7201a2a3e71302fc372387f120ce2c1bb9cbfea9692f455978bc04fee10dd876

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\wintrust.dll · signed by Microsoft Corporation

b7482d40f9c4ce525bd5548f480236288e3bbcbac60c9f0c0b051b0df069163b

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\wintrust.dll · signed by Microsoft Corporation

b772927ff8b517ddf5c3de52b2e30ef211dc7528ba1d3417fd0776f898633ef4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names wintrust.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.