CmdID

CmdID / Files

WWAHost.exe

Microsoft WWA Host file version info

Program on Windows 17 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WWAHost.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\
C:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft WWA Host

17 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WWAHost.exe · signed by Microsoft Windows

0e89760d40f8ba514be1b2dc063198bdecfb9f82d056d3c205c32b03433b24ea

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WWAHost.exe · signed by Microsoft Windows

53d66fa8d88e8a1f3e785c8d65dc5da5ceec86c1472c459f1741cacccc0d6fe8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

1739b99fd376ddd2b8b5d0b5607d4bbd1205373467f0409c2f60fbb33a698e28

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WWAHost.exe · signed by Microsoft Windows

1b3069159897dbbb2518c1698a4a62fde15e5475717ca177a3677b9e9d5fa7f9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

47a2c71b9dc22a967b0d4339fa93175cf1ccf0a982dce3dcd542afcdc54372f3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

5cc92002434e4ac10ed1c4463bd4db872b7371af01b88fbbb6fd6b3cb4af8961

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WWAHost.exe · signed by Microsoft Windows

7ed6b168f43f1283bde9b43e1fa474a59ede1b9df40c8f5b67d9577acae4b42e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

d0898b6a02b129ca90acd446c3390a22dda9273fd0599fd942b545679c2b8ea6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WWAHost.exe · signed by Microsoft Windows

dba38db00810a4321e7e97dcfd50c8bb12f24bc919e6222ffe08a48c0c0d0a8a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WWAHost.exe · signed by Microsoft Windows

7abdf4c9015a8dd42269fd9f7614106a98aef6265d6ec8ac8e2b4b6b16d7fec5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WWAHost.exe · signed by Microsoft Windows

f0b46523db79449c728fbf8ca8d5ae5ec78542d8d1653397e6a8896bc88900e7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WWAHost.exe · signed by Microsoft Windows

406c71c2bc1c4710ec2a034ea1fa7dc0e689e87c04a6b3a980f485b72ed41e08

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

40bf206f8e55f3c01a920ee3932984e01517a6e7196bd2c57e12e413da688448

10.0.14393.51 (rs1_release_inmarket.160801-1836) · C:\Windows\system32\WWAHost.exe · signed by Microsoft Windows

8e63723291e561b60f6ff36961291ef0839faebecddf2a3c1e9844c52d6017b5

10.0.14393.51 (rs1_release_inmarket.160801-1836) · C:\Windows\SysWOW64\WWAHost.exe · signed by Microsoft Windows

c5b22ed19399eb4681ed785329e197c1012d5785b22f237e2b45bba62b596a3a

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\SysWOW64\WWAHost.exe · not signed

074fe023b714ea1bce48a32737c903a904e55a3b8d32196f122a4082d6ab37e6

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\system32\WWAHost.exe · not signed

cf7c823de06062bf28cc4ce2afa2307f489dd6ea981b0b4e8a0a6e11dc68a405

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WWAHost.exe
highPotential Pikabot Hollowing ActivityAndreas Braathen (mnemonic.io)

Sigma names WWAHost.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.