Taskmgr.exe

  • File Path: C:\windows\system32\Taskmgr.exe
  • Description: Task Manager

Screenshot

Taskmgr.exe

Hashes

Type Hash
MD5 DAD789C1C1B03311DC7FCFEB5D1520E4
SHA1 3F63E9F09FE59F5A2D3740214E8D199C0CA4B3F9
SHA256 CCD091F425BB9B09DA3E293E33385786F1C9157DCDE60CF774FC55530760F537
SHA384 A20DFA0CEB2FDB625A7A9150A2AE43090898F492731467DB7FA1D6987D8C55080BCF70B93923D6C5F7C7CE1C9613AC10
SHA512 63E98889D90C34319E5D3ED044AC1FC5C90DF99D9DB6F9BB17531B45F2B8D7ED31B9E00DC4CD9D94CC7343FD9B3FAC843AABF60C92F38FB0DAAED01037698CF8
SSDEEP 24576:X1ogdgpbK3CdxOryqVYv1aAZYzOnZiFMZ/3I7fBe7q4HU:FoxpzxAySYv1anzOnF/Q5e7q4HU

Signature

  • Status: Signature verified.
  • Serial: 330000004EA1D80770A9BBE94400000000004E
  • Thumbprint: DF3B9B7E5AEA1AA0B82EA25F542A6A00963AB890
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Taskmgr.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of Taskmgr.exe being misused. While Taskmgr.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_susp_lsass_dump_generic.yml - '\taskmgr.exe' DRL 1.0
sigma win_alert_lsass_access.yml - 'C:\Windows\System32\Taskmgr.exe' DRL 1.0
sigma win_alert_lsass_access.yml - Some Taskmgr.exe related activity DRL 1.0
sigma file_event_win_creation_system_file.yml - '\Taskmgr.exe' DRL 1.0
sigma file_event_win_creation_system_file.yml - '\taskmgr.exe' DRL 1.0
sigma proc_access_win_cred_dump_lsass_access.yml - 'C:\WINDOWS\system32\taskmgr.exe' DRL 1.0
sigma proc_access_win_cred_dump_lsass_access.yml # - '\taskmgr.exe' DRL 1.0
sigma proc_access_win_lsass_memdump.yml description: Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. DRL 1.0
sigma proc_access_win_lsass_memdump.yml - https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html DRL 1.0
sigma proc_access_win_susp_proc_access_lsass.yml - 'C:\WINDOWS\system32\taskmgr.exe' DRL 1.0
sigma proc_creation_win_ransom_blackbyte.yml - 'del C:\Windows\System32\Taskmgr.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \taskmgr.exe DRL 1.0
sigma proc_creation_win_susp_taskmgr_localsystem.yml title: Taskmgr as LOCAL_SYSTEM DRL 1.0
sigma proc_creation_win_susp_taskmgr_localsystem.yml description: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM DRL 1.0
sigma proc_creation_win_susp_taskmgr_localsystem.yml Image\|endswith: '\taskmgr.exe' DRL 1.0
sigma proc_creation_win_susp_taskmgr_parent.yml title: Taskmgr as Parent DRL 1.0
sigma proc_creation_win_susp_taskmgr_parent.yml ParentImage\|endswith: '\taskmgr.exe' DRL 1.0
sigma proc_creation_win_susp_taskmgr_parent.yml - '\taskmgr.exe' DRL 1.0
sigma proc_creation_win_system_exe_anomaly.yml - '\Taskmgr.exe' DRL 1.0
signature-base crime_cn_campaign_njrat.yar $a3 = “taskkill /f /im taskmgr.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s2 = “Kiwi Taskmgr no-gpo” fullword wide CC BY-NC 4.0
signature-base thor_inverse_matches.yar description = “Anomaly rule looking for certain strings in a system file (maybe false positive on certain systems) - file taskmgr.exe” CC BY-NC 4.0
signature-base thor_inverse_matches.yar $s1 = “taskmgr.chm” fullword CC BY-NC 4.0
signature-base thor_inverse_matches.yar ( filename == “taskmgr.exe” or filename == “Taskmgr.exe” ) and not 1 of ($s*) and not WINDOWS_UPDATE_BDC CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.