ComputerDefaults.exe

  • File Path: C:\Windows\system32\ComputerDefaults.exe
  • Description: Set Program Access and Computer Defaults Control Panel

Screenshot

ComputerDefaults.exe

Hashes

Type Hash
MD5 AC4C3945A3E6DFFF98145096DA4EDA93
SHA1 FFA8ADAAA31F7B6FF7764C6AE877FCEDDB6AE975
SHA256 B2C06A97827F403848620CAAE012C284604B5093ED7950AC4EAD2B9EE4D28EB3
SHA384 1452E7096764F43725E2D6489441052D5BB61AAD9E2EF5A1688255FDD9564F289AD0DA309692CD29C220C094B567C9A6
SHA512 EA67E6656E87F5DF1ADB718D7B445CD49E89D210C4E4DE94B13FBF4B0B3AF96A665609B8A1AB02765F90012049C3D2B46CAF388E52EC71292F2C46B46C0DF878
SSDEEP 1536:kQOtu50MZS8EVCioHoL6u/a7WryQqURDoq4OZZZLlCIibB:knrWyiILS79KRD68wbB
IMP 00B74CCF8A4820BD574431AE64ECF0C5
PESHA1 07F68410C832FEDCF539890DCC56BE6392603CC2
PE256 447E2060FAE609120FB0BC83995F7BEA0EC29C968D2A74DF9D928F9BC1822958

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\combase.dll
C:\Windows\system32\ComputerDefaults.exe
C:\Windows\System32\cryptsp.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\shlwapi.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\system32\uxtheme.dll
C:\Windows\System32\win32u.dll
C:\Windows\System32\windows.storage.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: ComputerDefaults.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/b2c06a97827f403848620caae012c284604b5093ed7950ac4ead2b9ee4d28eb3/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ComputerDefaults.exe 52
C:\WINDOWS\system32\ComputerDefaults.exe 50
C:\WINDOWS\system32\ComputerDefaults.exe 50
C:\windows\system32\ComputerDefaults.exe 52
C:\Windows\system32\ComputerDefaults.exe 49
C:\Windows\system32\xwizard.exe 47
C:\windows\system32\xwizard.exe 52
C:\Windows\system32\xwizard.exe 46
C:\WINDOWS\system32\xwizard.exe 47
C:\WINDOWS\system32\xwizard.exe 49
C:\Windows\system32\xwizard.exe 44
C:\windows\SysWOW64\ComputerDefaults.exe 54
C:\WINDOWS\SysWOW64\ComputerDefaults.exe 50
C:\Windows\SysWOW64\ComputerDefaults.exe 50
C:\WINDOWS\SysWOW64\ComputerDefaults.exe 40
C:\Windows\SysWOW64\ComputerDefaults.exe 47
C:\Windows\SysWOW64\ComputerDefaults.exe 57
C:\WINDOWS\SysWOW64\xwizard.exe 49
C:\Windows\SysWOW64\xwizard.exe 49
C:\Windows\SysWOW64\xwizard.exe 49
C:\windows\SysWOW64\xwizard.exe 52
C:\Windows\SysWOW64\xwizard.exe 50
C:\WINDOWS\SysWOW64\xwizard.exe 55

Possible Misuse

The following table contains possible examples of ComputerDefaults.exe being misused. While ComputerDefaults.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_uac_bypass_computerdefaults.yml title: UAC Bypass Using ComputerDefaults DRL 1.0
sigma proc_creation_win_uac_bypass_computerdefaults.yml description: Detects the pattern of UAC Bypass using computerdefaults.exe (UACMe 59) DRL 1.0
sigma proc_creation_win_uac_bypass_computerdefaults.yml Image: 'C:\Windows\System32\ComputerDefaults.exe' DRL 1.0
sigma registry_event_shell_open_keys_manipulation.yml description: Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62) DRL 1.0
atomic-red-team index.md - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows] MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md - Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell) MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md ## Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell) MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10 MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Start-Process “C:\Windows\System32\ComputerDefaults.exe” MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.