Incident Response | ZipExec

What it is

An incident-response walkthrough of ZipExec (Optiv PoC) that goes past the mechanism to give three concrete, reproducible Windows-log detection points, keyed to Event ID 4688 (Process Creation). Test payload is calc.exe.

How it works

The generated JScript loader (run by wscript.exe) does three observable things in sequence: rebuilds a password-protected ZIP from a Base64 string into %TEMP% (via Scripting.FileSystemObject.GetSpecialFolder(2)), injects the ZIP password with cmdkey /generic, then executes the payload in place via shell.application COM verbs — no unzip step.

What to do

The page names three detection points, all catchable via 4688 plus one filemod rule:

1. ZIP filemod from wscript — wscript.exe writing a .zip into %TEMP%.
2. wscript spawns cmdkey — 4688 where Creator Process is wscript.exe and New Process is cmdkey.exe. Optionally RegEx the command line for the literal credential-target string: `` Microsoft_Windows_Shell_ZipFolder ` Observed command line: ` "C:\Windows\System32\cmdkey.exe" /generic:Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\vagrant\AppData\Local\Temp\calc.zip /pass:mrimBxyDv /user:"" ``
3. EXE spawning from inside a ZIP path — 4688 where wscript.exe spawns a process whose path runs through an expanded archive folder: `` C:\Users\...\AppData\Local\Temp\Temp1_calc.zip\calc.exe ``

Detection point 3 is the sharpest signal the summary omits: the executed path is Temp1_calc.zip\calc.exe (the shell's extraction folder), not the calc.zip that was written — so a rule matching the on-disk filename will miss the execution event. Match on the <name>.zip\<name>.exe process-path pattern instead.

flowchart TD
    A[wscript.exe runs loader] --> B[filemod: .zip in %TEMP%]
    A --> C[spawns cmdkey.exe<br/>Microsoft_Windows_Shell_ZipFolder]
    A --> D[spawns EXE from<br/>Temp1_zip\payload.exe]
    B -.detect 1.-> X[Alert]
    C -.detect 2.-> X
    D -.detect 3.-> X

Caveats

• The author states this is a PoC; an actor can obfuscate the loader to defeat the static/heuristic hits, but the process-lineage 4688 signals remain.
• Explicitly not a catch-all — author self-identifies as an IR practitioner, not a detection engineer, and calls these "three easy spots," not definitive coverage.
• The values mrimBxyDv, calc.zip, and all JScript variable names are randomized per run; only the structural patterns (process lineage, the Microsoft_Windows_Shell_ZipFolder string) are stable to alert on.
• Author notes further unexplored signals — e.g. netcons sourcing from a ZIP folder — and promised (unposted here) follow-up Splunk alerts.