Create Choice.exe

[4renSick]

This PR documents choice.exe as a helper binary that can be abused for execution
flow and timing control in malicious batch scripts.

While choice.exe does not execute payloads directly, it has been observed in
real-world ransomware activity (e.g., WastedLocker) as part of command chains
used to introduce silent delays before file manipulation or cleanup actions.

The included examples demonstrate how attackers can combine choice.exe with
other trusted Windows utilities (such as bitsadmin or attrib) to evade sandbox
analysis and reduce behavioral noise.

Reference:
SentinelOne – WastedLocker ransomware abusing NTFS file attributes

[4renSick]

Thanks for reviewing.
This entry documents choice.exe as a helper binary used for execution flow
and timing control, with a real-world reference from SentinelOne’s
WastedLocker analysis. Happy to update or adjust if needed.

[wietze]

Hey @4renSick , thank you for your suggestion.

Having reviewed your submission, I believe that unfortunately it does not meet the criteria this project has set out. That doesn't mean the functionality you documented is not useful for e.g. red teamers, but if my assessment is right, this entry would unfortunately not be the right fit for this project. For that reason I'm closing this pull request now, if you think I'm wrong though please comment in here and I'll reopen the pull request.

[4renSick]

Thank you @wietze for taking the time to review the submission and for the detailed feedback.
I understand your assessment regarding the scope and criteria of the project, and I agree that choice.exe primarily serves as a helper utility rather than enabling direct execution or payload retrieval on its own.
My intent with the submission was to document how attackers may abuse it as a control primitive in multi-stage batch-based tradecraft, but I appreciate that this does not align with the core inclusion requirements of LOLBAS.
I’m continuing my research in this area and hope that in the future I’ll be able to discover and contribute new binaries that better fit the project’s criteria.
Thanks again for the review and for maintaining the quality standards of the project.