Configures display settings
setres.exe -w 800 -h 600
Sets the resolution and then launches 'choice' command from the working directory.
Executes arbitrary code
c:\windows\system32\setres.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml, IOC: Unusual location for choice.exe file, IOC: Process created from choice.com binary, IOC: Existence of choice.cmd file
Grzegorz Tworek (@0gtweet)