Browser Cache Used to Stage Windows Batch Payloads
· 0:58 · Watch on YouTube ↗
Summary
The video demonstrates a Windows batch payload staged in browser cache and retrieved through a Run-dialog command. Network requests to cloudrecycled[.]com include the user agent, which may help determine which payload to serve.
Key points
- The demonstration shows browser cache holding a next-stage payload as a Windows batch script.
- A one-line command entered in the Run dialog retrieves the payload already placed on the file system.
- The browser’s network activity includes requests to cloudrecycled[.]com and a file identified only as “h.”
- Request and response data include the user agent, apparently used to identify the browser and determine which payload to serve.
Article Details
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudrecycled[.]com | Domain receiving network communications in the demonstration of browser-cache payload staging. |