CmdID

CmdID / Files

xcopy.exe

Extended Copy Utility file version info

Program on Windows 12 known copies with hashes 5 Sigma rules name it Command xcopy

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real xcopy.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionExtended Copy Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xcopy.exe · signed by Microsoft Windows

12143799b6c212e8267777929b73514222a6a6ea5d7970aa97fff415379948c1

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xcopy.exe · signed by Microsoft Windows

dc27161ecbf1fdef78210c998eb111fa9d960a3dcf909708f4b9121299b0538e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\xcopy.exe · signed by Microsoft Windows

269eb0728413654856f4b2ee1fa7838cd69672ebc11baed4caa63f58c2df5823

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xcopy.exe · signed by Microsoft Windows

b45997bb7c5fc6024685ee8752cf8ab871290a46b33e04fc4850a10077acba5a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xcopy.exe · signed by Microsoft Windows

309bad3c84c4830b6c71f8212a0cb13a44cc119bb4ebec57dfba0625ccdaec26

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xcopy.exe · signed by Microsoft Windows

c61fa91dac2b19b10ed137a8550e9b0ae47415d1dfdd12a783ce811e101f2e71

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\xcopy.exe · signed by Microsoft Windows

1c58e29c25b4065893dd4fbb6ed27bd8a04828a30396d581d7c641d21e910dc8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xcopy.exe · signed by Microsoft Windows

692c7a7a1a693ac5e49008292d2332cfa858c0aebdc945b05068f51af132c39b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\xcopy.exe · signed by Microsoft Windows

adb4a07a567002816658087b3e053e1a1b847be0216be0627f2302f55fe2c63f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\xcopy.exe · signed by Microsoft Windows

ebf89c15d0ce966b3bd6aa726e7db80fc545bac521c3ab99ef1d5942ed02528c

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\xcopy.exe · not signed

6bb3fbaa37e680269d90ab7448d8a2cb578510b6e179dff9d46f721deb06097d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\xcopy.exe · not signed

bd7ea44dfd278c44ab7e49437d44d6c279bb1da1f92c9afefcb02babaa00b360

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name xcopy.exe
highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)
mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
mediumHackTool - Jlaive In-Memory Assembly ExecutionJose Luis Sanchez Martinez (@Joseliyo_Jstnk)
mediumPotential Browser Data StealingNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Copy From or To System DirectoryFlorian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)