~/bokkapig
hack the box machine writeups

Mftrace.exe

type: OtherMSBinaries
Trace log generation tool for Media Foundation Tools.

Full path

C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\mftrace.exe
C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64\mftrace.exe
C:\Program Files (x86)\Windows Kits\10\bin\x86\mftrace.exe
C:\Program Files (x86)\Windows Kits\10\bin\x64\mftrace.exe

Commands

  1. ExecuteUser T1127

    Local execution of cmd.exe as a subprocess of Mftrace.exe.

    Mftrace.exe {PATH:.exe}

    Launch specified executable as a subprocess of Mftrace.exe.

    os: Windows

    Execute: EXE

Detection

Resources

acknowledgement: fabrizio @0rbz_