IExpress.EXE Binary Proxy Execution Through Diamond.EXE

Nasreddine Bencherchali (Nextron Systems)

Detects the execution of a binary named "diamond.exe" through "IExpress.EXE" The IExpress binary in almost all cases will spawn the "makecab" utility in order to create the ".cab" file requested by the users via the ".SED" files. Internally it offers a different mode if the ".SED" file specifies a CompressionMode called "QUANTUM". In this mode it will look for a binary named "diamond.exe". As this binary has been deprecated and is not available in newer version of Windows. Attackers can use this fact in order to execute any binary named "diamond.exe" located in the same directory of execution as IExpress.

Internal Research

2024-03-12 00:00:00

None

0de8c2eb-20d2-467f-963b-d197f1f475e1

attack.execution attack.t1218

Nextron Sigma feed only (private)