Execute
Execution Windows
Execute `control.exe` in the current working directory
Use Can be used to evade defensive countermeasures or to hide as a persistence mechanism
LOL · Binary
WorkFolders.exe
Execute
Execution Windows
`WorkFolders` attempts to execute `control.exe`. By modifying the default value of the App Paths registry key for `control.exe` in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe`, an attacker can achieve proxy execution.
Use Proxy execution of a malicious payload via App Paths registry hijacking.