Identifier / Programs / Windows

change.exe

Changes Remote Desktop Session Host server settings for logons, COM port mappings, and install mode. Windows commands reference

LOLBAS Execute 1 ATT&CK technique 1 documented command 9 known copies with hashes

How change.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

user

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for change.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Once executed, change.exe will execute chgusr.exe in the same folder. Thus, if change.exe is copied to a folder and an arbitrary executable is renamed to chgusr.exe, change.exe will spawn it. Instead of user, it is also possible to use port or logon as command-line option.

change.exe user

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for change.exe, by Idan Lerman, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for change.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real change.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionRemote Desktop Services Change Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\change.exe · signed by Microsoft Windows

d5150ce8166b97f76916ffe2683ca99b293e4ae8e450c14ea2031a7a767f3b9a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\change.exe · signed by Microsoft Windows

d2df044b73e57cb2ffab4beae33355301b124b7ca45861c683b97d376019d717

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\change.exe · signed by Microsoft Windows

9d509f6f0b21a33e758c50418bf5592b6a8078365f18aa3784ab6cd1023940bc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\change.exe · signed by Microsoft Windows

17cac86c16cf40741b5e0fd87ff02830694e1da2715f75e18231867b79e6df45

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\change.exe · signed by Microsoft Windows

41dc113da22bd4cf8454f12cd69e1b695fc2c78ee149ebc0dc02624425f00ca6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\change.exe · signed by Microsoft Windows

c5accee50bdd264776cd55be2779e5526ddaac18491b4a0f2abb9e94b18bf3ba

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\change.exe · signed by Microsoft Windows

c66bf7322deeaec6109fd82c700569e3322701afb5ec19006b51e3600eee86cb

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\change.exe · not signed

28e9e1c154aa7b11049aaddebc275341a90f23395c44e07aeeb08907aae7ec26

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\change.exe · not signed

f8399ae46822ea51e284ad43ed716350bb23f00ccb21e7171072e49e4cbe3060

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.