write.exe

Windows Write

Paths

• C:\Windows\write.exe
• C:\Windows\System32\write.exe
• C:\Windows\SysWOW64\write.exe

Commands

Execute

Executes a binary provided in default value of `HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe`.

Use case: Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.

Privileges: User

write.exe

Detection

• IOC: Changes to HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe
• Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml

Resources

• https://gist.github.com/mblzk/b8c5ff7c2bd0fb2b385cc2fdd119874b