CmdID

CmdID / Files

wordpad.exe

Windows Wordpad Application file version info

Program on Windows 6 known copies with hashes 10 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wordpad.exe?

file version info and known copies
Installed inC:\Program Files\windows nt\accessories\
C:\Program Files (x86)\windows nt\accessories\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Wordpad Application

6 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe · signed by Microsoft Windows

09f10e7344ca61b53a080e4d54c7cb6ecd4e3308254b350906437e29e7a7d9b2

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Windows NT\Accessories\wordpad.exe · signed by Microsoft Windows

44a6d65442c80b5db26742ff1f2a2a2363177f232917b714947b5cc520a4b5a7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Windows NT\Accessories\wordpad.exe · signed by Microsoft Windows

59b86c305d6ab3867b4f7099438dbfd2ef9f9662323628e2473af153e503f8f0

10.0.19041.1 (WinBuild.160101.0800) · C:\program files\Windows NT\Accessories\wordpad.exe · signed by Microsoft Windows

d14682453ae07f4204e17a3dcf53367bbf3e2af85088bf513fd728328ca8b275

10.0.17763.1075 (WinBuild.160101.0800) · C:\Program Files\windows nt\accessories\wordpad.exe · signed by Microsoft Windows

657e99bda5d2487f09f9302f661067b143f096c07c2ab64dd2ed24a2a51c8549

10.0.17763.1075 (WinBuild.160101.0800) · C:\Program Files (x86)\windows nt\accessories\wordpad.exe · signed by Microsoft Windows

c35624422ad35fea2989387539908130cd9cec17122ae9136c978dc91493ea9a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wordpad.exe
highPotential BlackByte Ransomware ActivityFlorian Roth (Nextron Systems)
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highSuspicious WMIC Execution Via Office ProcessVadim Khrykov, Cyb3rEng
mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems)

Sigma names wordpad.exe in 10 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.