setx.exe
Sources: 300M+ executions observed in the wild.
Summary
Set Environment Variable permanently. Unlike SET (session-only), SETX modifies environment variables persistently in the registry. Can be used for persistence via PATH manipulation or DLL search order hijacking setup.
setx.exe is the 2031st most commonly executed Windows program in EchoTrail's dataset, observed 296 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by minionhost.exe.
Get this in your tools
The same record for setx.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/setx.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3298.65%
- C:\Windows\SysWOW641.35%
Top Hashes (SHA256)
- add5d77a1dbae58f39dbd943b39dd08b71760d9117ea91d21e30f441805726b059.86%
- 50e36c9c167ad400a17f98ea75297bf925c403f084366903bac001ab1f3d2a5617.69%
- d2b3e89d84e8fe3684861563c88148e9f4dde14bcd814fcf72ed8804827a58af15.99%
- 4df07bc2f74879a6f190922cedafb9652f6488de0084fe91c6b62e62955a3a0a4.42%
- f72ddc48fc41f51499263f193020c8f0ca9a071c3d5462538af9e56f7e812a041.02%
- f207f3bf4b4d3f2c73db94baa69ce81cc0675f7c638b5d747c8c46f4323a2f440.68%
- 0173d840df8e41e2b178d4d99a444dd0770c1309cc2a76fd7f1cf5c850525f410.34%
Process Ancestry
Top Grandparents
- PylumLoader.exe96.5%
- cmd.exe1.4%
- RuntimeBroker.exe1.05%
- Update.exe0.7%
Top Parents
- minionhost.exe94.59%
- powershell.exe3.04%
- cmd.exe1.35%
- atom.exe0.34%
Top Children
- conhost.exe100%
Security Analysis
What does setx.exe normally do?
Runs from C:\Windows\System32. Used by administrators and installers to set persistent environment variables (PATH additions, JAVA_HOME, etc.).
When is setx.exe suspicious?
Modifying PATH to include attacker-controlled directories. Setting environment variables that redirect DLL loading. Execution by non-admin users modifying system-level variables (/M flag).
How do attackers abuse setx.exe?
PATH MANIPULATION: "setx PATH "%PATH%;C:\Users\attacker\malicious_dir" /M" — adds an attacker directory to the system PATH, enabling DLL search order hijacking or binary replacement attacks.
Detection guidance
LOW-PRIORITY: Monitor setx /M (system-level) changes to PATH and other security-relevant variables. DATA SOURCES: Process creation with command line (Sysmon 1), registry events (Sysmon 12/13)
False positive notes
Common in software installation scripts, developer environment setup, and IT configuration. Java, Python, and Node.js installations frequently use setx to modify PATH.
Related Processes
Ask Rocky about setx.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for setx.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.