Sitting on the Lolbins, 2

August 20, 2019 in Anti-Forensics, Living off the land, LOLBins, Reusigned Binaries

Here’s a little gift from Intel – an old autorun program iAutorun.exe that is signed and can be instructed to run other programs via the content of the autorun.inf file it processes:

XP_APPS_32=c:\windows\system32\notepad.exe
XP_APPS_64=c:\windows\system32\notepad.exe
VISTA_APPS_32=c:\windows\system32\notepad.exe
VISTA_APPS_64=c:\windows\system32\notepad.exe
WIN7_APPS_32=c:\windows\system32\notepad.exe
WIN7_APPS_64=c:\windows\system32\notepad.exe
WIN8_APPS_32=c:\windows\system32\notepad.exe
WIN8_APPS_64=c:\windows\system32\notepad.exe
WINPLUS_APPS_32=c:\windows\system32\notepad.exe
WINPLUS_APPS_64=c:\windows\system32\notepad.exe
RUNMODE=WAIT

Source: an installer for IntelĀ® PROSet/Wireless software.

Comments are closed.