CmdID

CmdID / Files

setspn.exe

Query or reset the computer's SPN attribute file version info

Program on Windows 9 known copies with hashes 1 Sigma rule names it Command setspn

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real setspn.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery or reset the computer's SPN attribute

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\setspn.exe · signed by Microsoft Windows

2e9ae04638485213d23b9e3a69b2663038b2b75d06df62ba21328cfea3f21093

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\setspn.exe · signed by Microsoft Windows

3ee597fa9b3333ab491807f48aec985c4429f975e0dabce2af0ccaa182628884

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\setspn.exe · signed by Microsoft Windows

b67dfb0b0bfe472ed2c047d3fa4c8d462dffe3a309741d3f5f616213dc3ec2ed

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setspn.exe · signed by Microsoft Windows

8438388897dfb56415372c74aa23d7c39f6863c0146024ed94e331b50574221e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\setspn.exe · signed by Microsoft Windows

cf095dbd04ebab55b598e0f27c88304571edc70f41156567c1700b70cd5e728b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\setspn.exe · signed by Microsoft Windows

391fda7796aab03c8362aa499acba93a58480d7b6982ab13f101a061cf8eb649

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\setspn.exe · signed by Microsoft Windows

909c2ddf06cfeb1f79004dbb5e9b9d36b693cfdff3459e0a6a51616b2ad6d2d1

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\setspn.exe · not signed

84b7b28db52ae454caba76b134895eb3244295cb3a45ec40acb9b5d653c96553

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\setspn.exe · not signed

e3b06217d90bd1a2c12852398ea0e85c12e58f0ecba35465e3dc60ac29ac0dc9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name setspn.exe
mediumPotential SPN Enumeration Via Setspn.EXEMarkus Neis, keepwatch