.. /Provlaunch.exe
Star

Execute

Launcher process


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. "reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0" and "reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe". Registry keys are deleted after successful execution.

    provlaunch.exe LOLBin
    Use case
    Executes arbitrary command
    Privileges required
    Administrator
    Operating systems
    Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
    ATT&CK® technique
    T1218