LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

WorkFolders.exe

View source

Work Folders

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Execute `control.exe` in the current working directory

COMMAND
WorkFolders
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXERequires · Rename
EXAMPLE 02T1218

`WorkFolders` attempts to execute `control.exe`. By modifying the default value of the App Paths registry key for `control.exe` in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe`, an attacker can achieve proxy execution.

COMMAND
WorkFolders
USE CASE
Proxy execution of a malicious payload via App Paths registry hijacking.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXERequires · Registry change
02 / ON DISK

Known paths

C:\Windows\System32\WorkFolders.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    WorkFolders.exe should not be run on a normal workstation

  • IOC

    Registry modification to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

John Carroll@YoSignals
Elliot Killick@elliotkillick
Naor Evgi@ghosts621