CmdID

CmdID / Files

SystemSettingsBroker.exe

System Settings Broker file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SystemSettingsBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Settings Broker

6 known copies

10.0.22000.37 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

dbf4986a814fd9c7d68b5fdd78005a043d85c85710e67fe6043202b627c4c157

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

0fe9631be461029b533a86df1c2e72be2539668333cb24c116e1c98344f26c34

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

c57b3ccded8efea55a1cdb794de2abf46b3bc1cee108768bf572388922dc6d7c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

7744422610c4f1e497d12c25ff32958991aa4e43185caf385e58804857e106b0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

18fdb4262a2a83f9f8d58e7a4370b18ab73dc0c89e0ad12264bfac266144ab26

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SystemSettingsBroker.exe · signed by Microsoft Windows

707ad52f04d0f8a4e9b1c383d6663938a353cfb440f47c820ec49987a595ebea

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SystemSettingsBroker.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.