runonce.exe

  • File Path: C:\Windows\SysWOW64\runonce.exe
  • Description: Run Once Wrapper

Hashes

Type Hash
MD5 9E16655119DDE1B24A741C4FD4AD08FC
SHA1 F7C7FA5952FC8E10961557E4A2CC055FC8812177
SHA256 4DBC301EA051ECDEA35D26F7666ACE0109CD8D1027C5361EC37E82623C0B5DB4
SHA384 A00DDA574EA5DB6B3B68FB48C3B3B152DD4B437550DF92E01B9A5C180098A071B4512BEA636DED8FD6DE015C92E1BB07
SHA512 F9957A1B644A634169AA2E46253F9731B7BD48B9876DBF6ACF206233FB94FBA118994A4D011971006A8C2739B8A0F8F45533115BD6FE47B5C6F77A5F9C95BC9B
SSDEEP 768:M686/iNUC+tFbpTSRkg3AAdYn7AJUeuFRseJgvDwJpex8ZVtvn:Mv6/iNUXDuX7meUeuFKrvcSaZVtv
IMP 97CC98DB681CF599B4F85D3B9CF8A780
PESHA1 1A9CAEA42A5C7A10D32A0C00B48915C1917E1E48
PE256 CFAF719E0D07B596A60BED4B015EA7788552F477B62C5CD7B7C156DD210697B1

Runtime Data

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\runonce.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002EC6579AD1E670890130000000002EC
  • Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: RUNONCE.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1202 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1202
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/4dbc301ea051ecdea35d26f7666ace0109cd8d1027c5361ec37e82623c0b5db4/detection

Possible Misuse

The following table contains possible examples of runonce.exe being misused. While runonce.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\runonce.exe' DRL 1.0
sigma proc_creation_win_cobaltstrike_process_patterns.yml ParentImage\|endswith: '\runonce.exe' DRL 1.0
sigma proc_creation_win_cobaltstrike_process_patterns.yml ParentCommandLine\|endswith: '\runonce.exe' DRL 1.0
sigma proc_creation_win_susp_rundll32_setupapi_installhinfsection.yml description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. DRL 1.0
sigma proc_creation_win_susp_rundll32_setupapi_installhinfsection.yml Image\|endswith: '\runonce.exe' DRL 1.0
sigma proc_creation_win_susp_runonce_execution.yml - '\runonce.exe' DRL 1.0
sigma registry_event_runonce_persistence.yml description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup DRL 1.0
LOLBAS Runonce.yml Name: Runonce.exe  
LOLBAS Runonce.yml - Command: Runonce.exe /AlternateShellStartup  
LOLBAS Runonce.yml - Path: C:\Windows\System32\runonce.exe  
LOLBAS Runonce.yml - Path: C:\Windows\SysWOW64\runonce.exe  

MIT License. Copyright (c) 2020-2021 Strontic.