LOLBAS/yml/OSBinaries/Xwizard.yml

22 lines
791 B
YAML

---
Name: Xwizard.exe
Description: DLL hijack, Execute
Author: ''
Created: '2018-05-25'
Categories: []
Commands:
- Command: xwizard.exe
Description: Xwizard.exe will load a .DLL file located in the same directory (DLL Hijack) named xwizards.dll.
- Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
Description: Xwizard.exe running a custom class that has been added to the registry.
Full Path:
- c:\windows\system32\xwizard.exe
- c:\windows\sysWOW32\xwizard.exe
Code Sample: []
Detection: []
Resources:
- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
- https://www.youtube.com/watch?v=LwDHX7DVHWU
- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
Notes: Thanks to Adam - @Hexacorn, Nick Tyrer - @nicktyrer