CmdID

CmdID / Files

DisplaySwitch.exe

Display Switch file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DisplaySwitch.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDisplay Switch

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DisplaySwitch.exe · signed by Microsoft Windows

787811303d1924c12e1fea4b2c314960c0aeb52476c4bb71dc0c79b08e750972

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DisplaySwitch.exe · signed by Microsoft Windows

8b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DisplaySwitch.exe · signed by Microsoft Windows

a5f3500875f4c482bd821b251b6a79e144c021a40e7054d10085619932ff4ff9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DisplaySwitch.exe · signed by Microsoft Windows

8e1484a283ebc8ed5f28970ab2ea5b488c5dca50b93c1209e5b2098552d294b9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\DisplaySwitch.exe · signed by Microsoft Windows

5e4e1662eb2d4d08d8d0d52f4f9bb9b30b61634f2b5e0799b03cfc098d8bef0a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\DisplaySwitch.exe · signed by Microsoft Windows

47bb2f510efd927d4bddf8f13503ddf077b1f0ed8427f64605dc9f60bd935b06

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\DisplaySwitch.exe · signed by Microsoft Windows

94cd03dfb938f5f0a999c77ca7fcc2320f6a8c570ac0f01a99a6dc9440c980d8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\DisplaySwitch.exe · signed by Microsoft Windows

1d5cba061142691df9d99380139653fae326ff15fd12d8cc1b91ead79194aa9d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\DisplaySwitch.exe · signed by Microsoft Windows

48d65601f501a99c4dbd6ac4501dedcba462e9e38507f089a10a5fea45e512b4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name DisplaySwitch.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro