ComputerDefaults.exe

  • File Path: C:\WINDOWS\SysWOW64\ComputerDefaults.exe
  • Description: Set Program Access and Computer Defaults Control Panel

Screenshot

ComputerDefaults.exe

Hashes

Type Hash
MD5 455CCBB47F4BEF02A9E0034859CE59E2
SHA1 D68118C7635FAD7BDD83E1AEAEF08E277C0EF5F4
SHA256 58BA527A7734600F3FF475A38A0CB233A883EFF4F09DFFE2B23686C9C8253F35
SHA384 66F4C931577B17BCC67F69AF59E3ACBB6D69AA50D716BA57A4085EA7F924250758E34484F8E7040D0EC855AAB6B0EE45
SHA512 58AA95D1CF3B058D61B094ECDE23D4BC9F9F2498A02EC9B1D30ED5DA74ABACE6CD810544F7E111FE1F050CFE8A0C14F74DA6ADF3B7564D660695F6B61FDD0705
SSDEEP 1536:05zu0Yg9vp+15SJrePojhZ7oyrURDoq4OZZZLlCIibe6:URBT+1gwRD68wbe

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: ComputerDefaults.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.267 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.267
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ComputerDefaults.exe 54
C:\WINDOWS\system32\ComputerDefaults.exe 54
C:\WINDOWS\system32\ComputerDefaults.exe 50
C:\Windows\system32\ComputerDefaults.exe 50
C:\windows\system32\ComputerDefaults.exe 57
C:\Windows\system32\ComputerDefaults.exe 46
C:\Windows\system32\xwizard.exe 47
C:\windows\system32\xwizard.exe 46
C:\Windows\system32\xwizard.exe 44
C:\WINDOWS\system32\xwizard.exe 44
C:\WINDOWS\system32\xwizard.exe 41
C:\Windows\system32\xwizard.exe 49
C:\windows\SysWOW64\ComputerDefaults.exe 55
C:\Windows\SysWOW64\ComputerDefaults.exe 52
C:\WINDOWS\SysWOW64\ComputerDefaults.exe 43
C:\Windows\SysWOW64\ComputerDefaults.exe 50
C:\Windows\SysWOW64\ComputerDefaults.exe 65
C:\Windows\SysWOW64\PickerHost.exe 22
C:\WINDOWS\SysWOW64\PickerHost.exe 25
C:\Windows\SysWOW64\UserAccountControlSettings.exe 27
C:\WINDOWS\SysWOW64\UserAccountControlSettings.exe 30
C:\WINDOWS\SysWOW64\xwizard.exe 49
C:\Windows\SysWOW64\xwizard.exe 50
C:\Windows\SysWOW64\xwizard.exe 47
C:\windows\SysWOW64\xwizard.exe 50
C:\Windows\SysWOW64\xwizard.exe 49
C:\WINDOWS\SysWOW64\xwizard.exe 46

Possible Misuse

The following table contains possible examples of ComputerDefaults.exe being misused. While ComputerDefaults.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_uac_bypass_computerdefaults.yml title: UAC Bypass Using ComputerDefaults DRL 1.0
sigma proc_creation_win_uac_bypass_computerdefaults.yml description: Detects the pattern of UAC Bypass using computerdefaults.exe (UACMe 59) DRL 1.0
sigma proc_creation_win_uac_bypass_computerdefaults.yml Image: 'C:\Windows\System32\ComputerDefaults.exe' DRL 1.0
sigma registry_event_shell_open_keys_manipulation.yml description: Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62) DRL 1.0
atomic-red-team index.md - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md - Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell) MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md ## Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell) MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10 MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Start-Process “C:\Windows\System32\ComputerDefaults.exe” MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.