setx.exe
Summary
Set Environment Variable permanently. Unlike SET (session-only), SETX modifies environment variables persistently in the registry. Can be used for persistence via PATH manipulation or DLL search order hijacking setup.
setx.exe is the 2031st most commonly executed Windows program in EchoTrail's dataset, observed 296 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by minionhost.exe.
Behavior
Top Paths
- C:\Windows\System3298.65%
- C:\Windows\SysWOW641.35%
Top Hashes (SHA256)
- add5d77a1dbae58f39dbd943b39dd08b71760d9117ea91d21e30f441805726b059.86%
- 50e36c9c167ad400a17f98ea75297bf925c403f084366903bac001ab1f3d2a5617.69%
- d2b3e89d84e8fe3684861563c88148e9f4dde14bcd814fcf72ed8804827a58af15.99%
- 4df07bc2f74879a6f190922cedafb9652f6488de0084fe91c6b62e62955a3a0a4.42%
- f72ddc48fc41f51499263f193020c8f0ca9a071c3d5462538af9e56f7e812a041.02%
- f207f3bf4b4d3f2c73db94baa69ce81cc0675f7c638b5d747c8c46f4323a2f440.68%
- 0173d840df8e41e2b178d4d99a444dd0770c1309cc2a76fd7f1cf5c850525f410.34%
Process Ancestry
Top Grandparents
- PylumLoader.exe96.5%
- cmd.exe1.4%
- RuntimeBroker.exe1.05%
- Update.exe0.7%
Top Parents
- minionhost.exe94.59%
- powershell.exe3.04%
- cmd.exe1.35%
- atom.exe0.34%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does setx.exe normally do?
Runs from C:\Windows\System32. Used by administrators and installers to set persistent environment variables (PATH additions, JAVA_HOME, etc.).
When is setx.exe suspicious?
Modifying PATH to include attacker-controlled directories. Setting environment variables that redirect DLL loading. Execution by non-admin users modifying system-level variables (/M flag).
How do attackers abuse setx.exe?
PATH MANIPULATION: "setx PATH "%PATH%;C:\Users\attacker\malicious_dir" /M" — adds an attacker directory to the system PATH, enabling DLL search order hijacking or binary replacement attacks.
Detection guidance
LOW-PRIORITY: Monitor setx /M (system-level) changes to PATH and other security-relevant variables. DATA SOURCES: Process creation with command line (Sysmon 1), registry events (Sysmon 12/13)
False positive notes
Common in software installation scripts, developer environment setup, and IT configuration. Java, Python, and Node.js installations frequently use setx to modify PATH.
Related Processes
Ask Rocky about setx.exe
Rocky answers questions about setx.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.