examples:
- description: "Place malicious winmm.dll in the search order location"
command: "copy malicious.dll "%SYSTEM32%\winmm.dll""
- description: "Execute the vulnerable binary to trigger the hijack"
command: ""%SYSTEM32%\mblctr.exe""
winmm.dll
Vendor: Microsoft
Expected Location: %SYSTEM32%
Vulnerable Executables:
- %SYSTEM32%\mblctr.exe (Sideloading)
- %SYSTEM32%\mspaint.exe (Sideloading)
- %SYSTEM32%\mstsc.exe (Sideloading)
- %SYSTEM32%\osk.exe (Sideloading)
- %SYSTEM32%\presentationsettings.exe (Sideloading)
- %SYSTEM32%\proximityuxhost.exe (Sideloading)
- %SYSTEM32%\wfs.exe (Sideloading)
- %SYSTEM32%\winsat.exe (Sideloading) [AutoElevate]
- %APPDATA%\Zoom\bin_%VERSION%\Zoom.exe (Sideloading)
Acknowledgement: Wietze
Acknowledgement: Chris Spehn
Acknowledgement: Josh Allman