CmdID

CmdID / Files

ksetup.exe

Kerberos Setup tool file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it Command ksetup

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ksetup.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionKerberos Setup tool

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ksetup.exe · signed by Microsoft Windows

70e439f5f43b02d24d94c32ff837d35e29b12c5eed913d29c2f7e3e07a5feca4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ksetup.exe · signed by Microsoft Windows

8de772dc39de39e6d156529e9130e61079e400a14116b42a7e8614d509b68c30

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ksetup.exe · signed by Microsoft Windows

5a2a842946000d1651be881718bb6be9d292629a8038c5c0bc40bc92bf9c1de6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ksetup.exe · signed by Microsoft Windows

19373acc55f4daa9810341a2b164f0b7346a1e2ee5d18a6c75d20e7b0394fb08

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ksetup.exe · signed by Microsoft Windows

83b79562a118524ef74f15b264e50aeb5307bdda765f5413aaddb894ed742da5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ksetup.exe · signed by Microsoft Windows

1dbe0a1a0fc8e8abeda38df7c81538296033d8d857c83b8c22b95a109c3ffa8f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ksetup.exe · signed by Microsoft Windows

d84ec1fcb3ab841c32efea8a3c821fdd7addbcafc678d26620479d8c5679d2fa

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ksetup.exe · not signed

5c6ba7844252ef3b207953fc2de7860801cf9213173823bb203a187adf6e5e5c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ksetup.exe · not signed

80a7e82326dc311cfd9dee9cc2bba4e744f4e5a99ba2e298ab7dd966170f1831

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ksetup.exe
mediumComputer Password Change Via Ksetup.EXENasreddine Bencherchali (Nextron Systems)
mediumLogged-On User Password Change Via Ksetup.EXENasreddine Bencherchali (Nextron Systems)