write.exe

Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`.

Use Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.

write.exe

Context

user

Native

Execute

MITRE

T1218

Detection

IOC: Changes to HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe

Sigma: github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml

Refs

gist.github.com/mblzk/b8c5ff7c2bd0fb2b385cc2fdd119874b

lolbas-project.github.io/lolbas/Binaries/write/