LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Colorcpl.exe

View source

Binary that handles color management

Copy
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Copy1

EXAMPLE 01T1036.005

Copies the referenced file to C:\Windows\System32\spool\drivers\color\.

COMMAND
colorcpl {PATH}
USE CASE
Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\colorcpl.exe
C:\Windows\SysWOW64\colorcpl.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    colorcpl.exe writing files

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

eral4m@eral4m