Url.dll

type: OSLibraries

Internet Shortcut Shell Extension DLL.

Full path

c:\windows\system32\url.dll
c:\windows\syswow64\url.dll

Commands

ExecuteUser T1218.011
Invoke an HTML Application via mshta.exe (Default Handler).
```
rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}
```
Launch a HTML application payload by calling OpenURL.
os: Windows 10, Windows 11
Execute: HTA
ExecuteUser T1218.011
Load an executable payload by calling a .url file.
```
rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.url}
```
Launch an executable payload via proxy through a .url (information) file by calling OpenURL.
os: Windows 10, Windows 11
Execute: URL
ExecuteUser T1218.011
Load an executable payload by specifying the file protocol handler (obfuscated).
```
rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
```
Launch an executable by calling OpenURL.
os: Windows 10, Windows 11
Execute: EXE
ExecuteUser T1218.011
Launch an executable.
```
rundll32.exe url.dll,FileProtocolHandler {PATH_ABSOLUTE:.exe}
```
Launch an executable by calling FileProtocolHandler.
os: Windows 10, Windows 11
Execute: EXE
ExecuteUser T1218.011
Load an executable payload by specifying the file protocol handler (obfuscated).
```
rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
```
Launch an executable by calling FileProtocolHandler.
os: Windows 10, Windows 11
Execute: EXE
ExecuteUser T1218.011
Invoke an HTML Application via mshta.exe (Default Handler).
```
rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta
```
Launch a HTML application payload by calling FileProtocolHandler.
os: Windows 10, Windows 11
Execute: HTA

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Resources

acknowledgement: Adam (OpenURL) @hexacorn, Jimmy (OpenURL) @bohops, Malwrologist (FileProtocolHandler - HTA) @DissectMalware, r0lan (Obfuscation) @r0lan