.. / Infdefaultinstall

Star

• Execute

Binary used to perform installation based on content inside inf files

Paths:

• C:\Windows\System32\Infdefaultinstall.exe
• C:\Windows\SysWOW64\Infdefaultinstall.exe

• https://twitter.com/KyleHanslovan/status/911997635455852544
• https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/

Acknowledgement:

• Kyle Hanslovan - @kylehanslovan

Detection:

Execute

The LOLBAS can achieve abritrary code execution.

• Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

  Usecase:Code execution

  InfDefaultInstall.exe Infdefaultinstall.inf

• Privileges required:User
• OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
• Mitre:T1218