CmdID

CmdID / Files

sethc.exe

Accessibility shortcut keys file version info

Program on Windows 16 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sethc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAccessibility shortcut keys

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sethc.exe · signed by Microsoft Windows

21c5e81d840b99627d2da2ef4f67751bd977cb046d670aca1863dd0816532d40

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sethc.exe · signed by Microsoft Windows

8645ce8236e4e17cda5914556fb76e578abfe4996ce367d1e3dfa3f53b221139

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sethc.exe · signed by Microsoft Windows

8798c149f63e1573e7aec72e61796c95793866ef84375e521eb92940e2105f59

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sethc.exe · signed by Microsoft Windows

4683f7ef0b0984be03388e0003d3e9bc20ed54b7941aa8638e1d7ac0a2d531d3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sethc.exe · signed by Microsoft Windows

615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sethc.exe · signed by Microsoft Windows

d4bb52d9e13a5b26cbcd96f5ce78005ff28b4eca91e6ec3b86ed31d51ad1472f

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sethc.exe · signed by Microsoft Windows

408e8b6c66411a1f3e05e5fd330b1b921e63fe3dbdf436c17f9670fe72ba76b6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sethc.exe · signed by Microsoft Windows

df4cc0eb831cc48d45f21b280c1d78800b5ae107a65070c63de506d3ab5adec5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sethc.exe · signed by Microsoft Windows

52a9e16b777d1ffbba54a686f9d77ae0aa622ec2fd7a501cea398b7a53e64793

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\SysWOW64\sethc.exe · signed by Microsoft Windows

708dceedc93b0da05583e0320fbd36b952e1dba1f5c896ccac2fbf1ba0d86c17

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\sethc.exe · signed by Microsoft Windows

746d48a2fc0198e20c6abcb301ed5c0ffebde33d0c0c890044ec98c9ee5e21ec

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sethc.exe · signed by Microsoft Windows

ce13c119e81d353fd25ff6088ad011251259210bb2f2e72399a67887a4f2c2fb

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sethc.exe · signed by Microsoft Windows

2dfcaa75bfb6efbd24a0862c80f90798be480f656a434c5ace7eeb618835c78a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sethc.exe · signed by Microsoft Windows

f65ed2a3dbec005feab3b2bfa104674179c275f80c732daaf8d72530abb3e186

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sethc.exe · not signed

10fb638dc9c7e7d0961ace87320a0bd7ca48918bbb818038ac807b1172033c36

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sethc.exe · not signed

f7056041988a7ca29ff6c341a1f9efe94c90c2cf47e9078acab3b97f1f18e123

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sethc.exe
criticalPersistence Via Sticky Key BackdoorSreeman
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highSuspicious Debugger Registration CmdlineFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

Sigma names sethc.exe in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.