38 lines
662 B
Markdown
38 lines
662 B
Markdown
|
## Nvuhda6.exe
|
||
|
|
|
||
|
|
* Functions: Execute, Copy, Add registry, Create shortcut, kill process
|
||
|
|
|
||
|
|
```
|
||
|
|
nvuhda6.exe System calc.exe
|
||
|
|
|
||
|
|
nvuhda6.exe Copy test.txt,test-2.txt
|
||
|
|
|
||
|
|
nvuhda6.exe SetReg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\malware=malware.exe
|
||
|
|
|
||
|
|
nvuhda6.exe CreateShortcut test.lnk,"Test","c:\windows\system32\calc.exe","","c:\windows\system32"
|
||
|
|
|
||
|
|
nvuhda6.exe KillApp calculator.exe
|
||
|
|
|
||
|
|
nvuhda6.exe Run foo
|
||
|
|
```
|
||
|
|
|
||
|
|
Acknowledgements:
|
||
|
|
* Adam - @hexacorn
|
||
|
|
|
||
|
|
Code sample:
|
||
|
|
*
|
||
|
|
|
||
|
|
Resources:
|
||
|
|
* http://www.hexacorn.com/blog/2017/11/10/reusigned-binaries-living-off-the-signed-land/
|
||
|
|
|
||
|
|
Full path:
|
||
|
|
```
|
||
|
|
?
|
||
|
|
```
|
||
|
|
|
||
|
|
Notes:
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|