Written AppData file named in Windows executable-open command
A sandbox run recorded a file written to the current user’s AppData directory and a `.exe` open command that placed that same file before the program being launched. The match supports a configured launch intermediary, but the record does not show a later launch taking that route.
A Windows executable wrote sidebar.exe beneath the current user’s AppData directory and changed the user’s .exe open command to point to that same file. The new command placed sidebar.exe /START before the executable being opened and its arguments. That raises a more consequential question than whether the sample contacted a suspicious address: was it positioning its own code in the path used to launch other programs? The CAPE Sandbox record supports that interpretation of the setting.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read