recover.exe

  • File Path: C:\WINDOWS\system32\recover.exe
  • Description: Recover Files Utility

Hashes

Type Hash
MD5 65554E32A661D41FBB9FD2B8F8749AF2
SHA1 47FB81CC690A80A0E70330D9B1115B1B997A3281
SHA256 56CE9555153058218B159C7B0BB4B41F57E65F501871F5466E653B5EDD9DF804
SHA384 A42B5C190C275911D4D8E689CEEDD61546BD08DCA80CA85FE4DE83615BC974A21739CE805C9A6C4FC2294239E46DE625
SHA512 957BFD299E681EB10EB7F90D2147CB0968AA0A0527388EEE6B18CCBE38D2BF491877800F35A0F95DEE2A9CB5BD5DD766166A6646D8A9E61BE8730A40FB99E2B8
SSDEEP 192:d5jj+o/Wzi9jdt0etw2/EaD0f8UqY0tDNCSsm2DWbnW7:z+o/SiFdt0ejEaD9xJN2DWbnW
IMP 15EC0ACE85D3228ADCC66943670EF7D8
PESHA1 D8A814E0A09D00EB9CEA66384AC1A7F4F72F1AD5
PE256 B0FEF214B1780066442B412C3ADAB12E6327F603F4D8DB5CDE2F5272467208B9

Runtime Data

Usage (stdout):

Recovers readable information from a bad or defective disk.

RECOVER [drive:][path]filename
Consult the online Command Reference in Windows Help
before using the RECOVER command.

Child Processes:

conhost.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\ulib.dll.mui File
(RW-) C:\Windows\System32 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\recover.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Recover.Exe.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/56ce9555153058218b159c7b0bb4b41f57e65f501871f5466e653b5edd9df804/detection

File Similarity (ssdeep match)

File Score
C:\WINDOWS\SysWOW64\recover.exe 33

Possible Misuse

The following table contains possible examples of recover.exe being misused. While recover.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma azure_keyvault_key_modified_or_deleted.yml - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION DRL 1.0
sigma azure_keyvault_secrets_modified_or_deleted.yml - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION DRL 1.0
sigma proc_creation_win_sqlcmd_veeam_dump.yml - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html DRL 1.0
atomic-red-team T1048.003.md 3. Once the data is received, use the below command to recover the data. MIT License. © 2018 Red Canary
atomic-red-team T1110.002.md <blockquote>Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping is used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1485.md RansomEXX malware removes all deleted files using windows built-in cipher.exe to prevent forensic recover. MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

recover

Recovers readable information from a bad or defective disk. This command reads a file, sector-by-sector, and recovers data from the good sectors. Data in bad sectors is lost. Because all data in bad sectors is lost when you recover a file, you should recover only one file at a time.

Bad sectors reported by the chkdsk command were marked as bad when your disk was prepared for operation. They pose no danger, and recover does not affect them.

Syntax

recover [<drive>:][<path>]<filename>

Parameters

Parameter Description
[<drive>:][<path>]<filename> Specifies the file name (and the location of the file if it is not in the current directory) you want to recover. Filename is required and wildcards aren’t supported.
/? Displays help at the command prompt.

Examples

To recover the file story.txt in the \fiction directory on drive D, type:

recover d:\fiction\story.txt

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.