mstsc.exe

  • File Path: C:\Windows\SysWOW64\mstsc.exe
  • Description: Remote Desktop Connection

Screenshot

mstsc.exe mstsc.exe mstsc.exe

Hashes

Type Hash
MD5 035314ECE0D2904CD11B070D3DFF6E7C
SHA1 C04DADEF7E27983972BC1BD93304DCF8FFA7E28C
SHA256 08AAB0687C052AFCB0959DD9F5580745336C7B14E1ACD40EBA32E8B326F8BFFC
SHA384 D9B1F6D4B2BC6E8DD2F683166962ECEF0495CCAA6D8FDAAB0C2FEC9FC7AC450C09D8B70954D68981C6DD234F510BDCCB
SHA512 4AD8F27F3ADA7AF84509853A4E1490ABFB0EDBCE78420A20AD64C50F168B050275E209CD053AF723081E9C012D374554379D03C50E549DEBB9A5B0B30800EA79
SSDEEP 24576:mS2n2Y4wHj7ZjE4M5FuG2/07hawMS7tCGmQYOozji/ZbSG9gMmzHtKBnHD8ougt:Vm25wxG63ln8djV
IMP 3B243D5A3E7930EA33DE363F732B781D
PESHA1 4D899A965772779396383D88614CDAF952F9C3BA
PE256 21CB1073C4EE60F24832CAEB5EB560C0F472C19342D8C1241964E9E4B9689D79

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: mstsc.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.423 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.423
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/08aab0687c052afcb0959dd9f5580745336c7b14e1acd40eba32e8b326f8bffc/detection

Possible Misuse

The following table contains possible examples of mstsc.exe being misused. While mstsc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_tsclient_filewrite_startup.yml Image\|endswith: '\mstsc.exe' DRL 1.0
sigma net_connection_win_susp_rdp.yml - '\mstsc.exe' DRL 1.0
sigma proc_creation_win_mimikatz_command_line.yml - 'mstsc' #ts module DRL 1.0
sigma proc_creation_win_mstsc.yml title: Remote Desktop Protocol Use Mstsc DRL 1.0
sigma proc_creation_win_mstsc.yml - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc DRL 1.0
sigma proc_creation_win_mstsc.yml Image\|endswith: \mstsc.exe DRL 1.0
sigma proc_creation_win_rdp_hijack_shadowing.yml title: MSTSC Shadowing DRL 1.0
sigma proc_creation_win_rdp_hijack_shadowing.yml description: Detects RDP session hijacking by using MSTSC shadowing DRL 1.0
sigma registry_event_mstsc_history_cleared.yml description: Detects the deletion of registry keys containing the MSTSC connection history DRL 1.0
atomic-red-team T1021.001.md mstsc /v:$Server MIT License. © 2018 Red Canary
atomic-red-team T1021.001.md $p=Tasklist /svc /fi “IMAGENAME eq mstsc.exe” /fo csv | convertfrom-csv MIT License. © 2018 Red Canary
signature-base cn_pentestset_tools.yar $s1 = “srv\newclient\lib\win32\obj\i386\mstsc.pdb” fullword ascii CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $a2 = “taskkill /f /im mstsc.exe” fullword ascii CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


mstsc

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Creates connections to Remote Desktop Session Host servers or other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration file, and migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files.

Syntax

mstsc.exe [<connectionfile>] [/v:<server>[:<port>]] [/admin] [/f] [/w:<width> /h:<height>] [/public] [/span]
mstsc.exe /edit <connectionfile>
mstsc.exe /migrate

Parameters

Parameter Description
<connectionfile> Specifies the name of an .rdp file for the connection.
/v:<server>[:<port>] Specifies the remote computer and, optionally, the port number to which you want to connect.
/admin Connects you to a session for administering the server.
/f Starts Remote Desktop Connection in full-screen mode.
/w:<width> Specifies the width of the Remote Desktop window.
/h:<height> Specifies the height of the Remote Desktop window.
/public Runs Remote Desktop in public mode. In public mode, passwords and bitmaps aren’t cached.
/span Matches the Remote Desktop width and height with the local virtual desktop, spanning across multiple monitors if necessary.
/edit <connectionfile> Opens the specified .rdp file for editing.
/migrate Migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files.
/? Displays help at the command prompt.
Remarks
  • Default.rdp is stored for each user as a hidden file in the user’s Documents folder.

  • User created .rdp files are saved by default in the user’s Documents folder, but can be saved anywhere.

  • To span across monitors, the monitors must use the same resolution and must be aligned horizontally (that is, side-by-side). There is currently no support for spanning multiple monitors vertically on the client system.

Examples

To connect to a session in full-screen mode, type:

mstsc /f

or

mstsc /v:computer1 /f

To assign width/height, type:

mstsc /v:computer1 /w:1920 /h:1080

To open a file called filename.rdp for editing, type:

mstsc /edit filename.rdp

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.