LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

write.exe

View source

Windows Write

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`.

COMMAND
write.exe
USE CASE
Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11 (before 24H2)
Execute · EXERequires · Registry Change
02 / ON DISK

Known paths

C:\Windows\write.exe
C:\Windows\System32\write.exe
C:\Windows\SysWOW64\write.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Changes to HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Michal Belzak