From 72526529209a048bdf147c952c4453eb486c6fe3 Mon Sep 17 00:00:00 2001 From: Santiago Bruno Date: Wed, 23 Jan 2019 20:04:12 -0300 Subject: [PATCH 1/2] replacing ie4unit occurrences with ie4uinit --- yml/OSBinaries/Ie4unit.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/yml/OSBinaries/Ie4unit.yml b/yml/OSBinaries/Ie4unit.yml index e994403..ad141e3 100644 --- a/yml/OSBinaries/Ie4unit.yml +++ b/yml/OSBinaries/Ie4unit.yml @@ -1,10 +1,10 @@ --- -Name: Ie4unit.exe +Name: Ie4uinit.exe Description: Author: 'Oddvar Moe' Created: '2018-05-25' Commands: - - Command: ie4unit.exe -BaseSettings + - Command: ie4uinit.exe -BaseSettings Description: Executes commands from a specially prepared ie4uinit.inf file. Usecase: Get code execution by copy files to another location Category: Execute @@ -13,14 +13,14 @@ Commands: MitreLink: https://attack.mitre.org/wiki/Technique/T1218 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - - Path: c:\windows\system32\ie4unit.exe - - Path: c:\windows\sysWOW64\ie4unit.exe + - Path: c:\windows\system32\ie4uinit.exe + - Path: c:\windows\sysWOW64\ie4uinit.exe - Path: c:\windows\system32\ieuinit.inf - Path: c:\windows\sysWOW64\ieuinit.inf Code_Sample: - Code: Detection: - - IOC: ie4unit.exe loading a inf file from outside %windir% + - IOC: ie4uinit.exe loading a inf file from outside %windir% Resources: - Link: https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ Acknowledgement: From 64623edd6ecef2d58d3b5aba37b622c5263c5fbc Mon Sep 17 00:00:00 2001 From: Santiago Bruno Date: Wed, 23 Jan 2019 20:06:16 -0300 Subject: [PATCH 2/2] Renaming Ie4unit.yml as Ie4uinit.yml since this is the correct binary name --- yml/OSBinaries/{Ie4unit.yml => Ie4uinit.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename yml/OSBinaries/{Ie4unit.yml => Ie4uinit.yml} (100%) diff --git a/yml/OSBinaries/Ie4unit.yml b/yml/OSBinaries/Ie4uinit.yml similarity index 100% rename from yml/OSBinaries/Ie4unit.yml rename to yml/OSBinaries/Ie4uinit.yml