Colorcpl.exe

Copies the referenced file to C:\Windows\System32\spool\drivers\color\.

Use Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.

colorcpl {PATH}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Copy

MITRE

T1036.005

Detection

Sigma: github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml

IOC: colorcpl.exe writing files

Refs

twitter.com/eral4m/status/1480468728324231172

lolbas-project.github.io/lolbas/Binaries/Colorcpl/