February 5, 2021 in LOLBins
I was toying around with the Office application MSOXMLED.EXE and noticed it handles URLs. Thanks to that it can be used to download file to internet cache folder as shown below:
There are at least two different ways to invoke it:
MSOXMLED.EXE /verb open [URL]
MSOXMLED.EXE /verb [anything] /genverb open [URL]
and the file is being downloaded to the InetCache folder:
c:\Users\[user]\AppData\Local\Microsoft\Windows\INetCache\Low\IE\[random]\[file]
The caveat is that it seems to be using Internet Explorer as a proxy, hence the iexplore.exe will be spawn.
Lame, not very ‘finesse’, but at least documented.