WorkFolders.exe

Work Folders

Execute

Can be used to evade defensive countermeasures or to hide as a persistence mechanism

WorkFolders

Execute `control.exe` in the current working directory — MITRE: T1218 — Privileges: User

Proxy execution of a malicious payload via App Paths registry hijacking.

WorkFolders

`WorkFolders` attempts to execute `control.exe`. By modifying the default value of the App Paths registry key for `control.exe` in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe`, an attacker can achieve proxy execution. — MITRE: T1218 — Privileges: User