CmdID

CmdID / Files

wusa.exe

Windows Update Standalone Installer file version info

Program on Windows 14 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wusa.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Update Standalone Installer

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wusa.exe · signed by Microsoft Windows

0cb59520d3858469821d4bde32e003cf4328f0931bc345473459ee071723d978

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wusa.exe · signed by Microsoft Windows

50af95b82a9fc4f25b5443b2582bc76ef8fdd64792bb8da9b64ec7312da37452

10.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wusa.exe · signed by Microsoft Windows

ccda2c9e74e594dbe18e1eb0299986f3de9dab807d6890f812be5a103c2b90ee

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wusa.exe · signed by Microsoft Windows

2af3885ab02e20b64c60ae7d8e2b3e07667529c5a7699ce16ad83d33ab781020

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wusa.exe · signed by Microsoft Windows

3e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wusa.exe · signed by Microsoft Windows

5ae6a1f1135e9423d4cb409967591f776f7729c7b784e76380b4c727b89538aa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wusa.exe · signed by Microsoft Windows

4166fbfa83d143585b0092e6cb354859529efbd7a5d3092d028242de60d86f48

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wusa.exe · signed by Microsoft Windows

b38c8c76d561271ba6f49ad9645d06cd8c1733cfd55e4fdaeed1d41682d67baf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wusa.exe · signed by Microsoft Windows

9a18550136d91fd0af3d8d3e202a5a348ddee9639498f2b5fc9630e83406d7e1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wusa.exe · signed by Microsoft Windows

e0438c5594a4eeb8515518989ee3a773581f414273b857b885d2201f66a95b06

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wusa.exe · signed by Microsoft Windows

4b99324c4f640176227929722c40e383c3ae5d66a99763cda908dce7773525fa

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wusa.exe · signed by Microsoft Windows

5aa6b0e7d1839a1e430db80f180a09d7c07657ddc35c3396756d5cbef72b75c8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wusa.exe · not signed

1e384e490aff301349d27c37139d304edc83cf62571875540ab468e3b0d65c06

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wusa.exe · not signed

ee8c9a8e161047f68b9ac1e81592587c63bc218389430eacac0a8cac3380ab0a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wusa.exe
highCab File Extraction Via Wusa.EXE From Potentially Suspicious PathsNasreddine Bencherchali (Nextron Systems)
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
highUAC Bypass Using NTFS Reparse Point - ProcessChristian Burkard (Nextron Systems)
highWusa.EXE Executed By Parent Process Located In Suspicious LocationX__Junior (Nextron Systems)
mediumCab File Extraction Via Wusa.EXENasreddine Bencherchali (Nextron Systems)