little secret of msconfig.exe
This post doesn’t include anything ground breaking, but is just yet another attempt to describe/document less-known command line arguments of many known, often native to the platform, Windows programs....
View Article1 little known secret of forfiles.exe, part 2
In this old post I have demonstrated how to abuse forfiles.exe to run your ‘cmd.exe’ of choice. There is one more trick we can do with this tool. When forfiles.exe enumerates the files it executes a...
View ArticleSome unintelligent fun with ms-notepad protocol
In my previous post I have provided a list of ‘new’ protocols I noticed in the latest Windows 11 build. One that immediately caught my attention was “ms-notepad://”. You can use it to launch Notepad...
View ArticleA few more protocol handlers :), Part 2
In 2018 I published this post. In 2022 I published this post and this post. @Radkeyboard7984 and I continue chatting about the new Windows 11 protocols and I just did a quick comparison between the...
View ArticleWerReportCreate API
The API I want to talk about today is called WerReportCreate. It takes a few arguments, but the most interesting is the first one, which is the Event Name. Looking at Windows OS binaries, we can see...
View ArticleShimBad the Sailor, Part 3
Windows 11 brings us a lot of new Shim-related goodies and it makes sense to cover at least some of them. In the second part of this series I listed a number of process names that are treated in a …...
View Article1 little known secret of sti_ci.dll
In 2017 I posted about sideloading of sti_ci.dll. And it’s that DLL itself that executes the InstallWiaDevice installation command mentioned in that post… How? Via its export function called…...
View ArticleBeyond good ol’ Run key, Part 153
This Registry entry: HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Test\AdmParseLibrary=<DLL> is of interest as it relates to TestHooks library that is loaded when *.admx template...
View ArticleChina Domain Name Scammers target Hexacorn
A few days ago, I have received the following note from mike.zhang@domainregistrar [.] net [.] cn: Without thinking too much, I replied that I don’t know that company. Darn, that was the hook. Scammer...
View Article1 little known secret of help.exe
When you run help.exe it prints out a lot commands that it supports. The below is a snapshot from Windows 11: For more information on a specific command, type HELP command-name ASSOC Displays or...
View Article1 little known secret of nslookup.exe, part 2
This is a little lolbin trick you can do with a nslookup.exe program. One of the less-known nslookup.exe commands is view <filename>. When executed, it reads a content of a given file and sorts...
View Article1 little known secret of wsreset.exe
The wsreset.exe program is a known lolbin, but it has a lot more to offer than is currently known. When it is invoked with a command line argument /refreshlicenses it loads a licensemanagerapi.dll...
View ArticleForensics of the past
Few days ago my buddy and I had a chat about so-called old-school forensics. The one where you often used Encase, and – if you were inclined enough – EnScript scripting. This convo led me to my old...
View Articlentprint.exe lolbin
You can copy c:\WINDOWS\system32\ntprint.exe to a folder of your liking f.ex. c:\test, and then launch it with command line arguments like this: ntprint.exe PSetupElevatedLegacyPrintDriverInstallW {}...
View ArticleUsing .LNK files as lolbins
I am not sure if I or anyone else pointed it out before. Highly possible. I kinda lost track of it at this stage… So, anyway… this is a pretty dumb lolbin functionality that is exhibited by many native...
View ArticleRunDll Exporters
One of the most interesting classes of functions that are exported by DLLs are functions that use the RunDll interface (this archived article describes it). Thanks to traditional (today kinda...
View ArticleEnter Sandbox 30: Static Analysis gone wrong
This series is quite old, and I kinda abandoned it at some stage, but today I am reviving it to talk about … static analysis… Let’s be honest – last 2 decades changed the way we do malware analysis,...
View ArticleBeyond good ol’ Run key, Part 151
Yes, they keep coming. There are still many Windows persistence mechanisms that are not described properly and my mission is to cover it all. Some of these mechanisms may be seen as archaic, unusual,...
View ArticleDLL ForwardSideloading, Part 2
The 2nd part following my first take on this subject was kinda inevitable. Why? Sixtyvividtails is one of my fav researchers, because a) he reads my posts, breaks them apart, and usually comes up with...
View ArticleDLL ForwardSideloading
Some DLLs export functions (via export table) that are just forwarding execution to functions implemented in other libraries. It’s a very common practice and one of the most known forwards are:...
View Article
