Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript
Tags
attack-pattern: Direct Distributed Component Object Model - T1021.003 Malicious File - T1204.002 Powershell - T1059.001 Regsvr32 - T1218.010 Distributed Component Object Model - T1175 Powershell - T1086 Regsvr32 - T1117
Show in Graph
Common Information
Type Value
UUID 29fec623-6c9c-49e8-95f0-89064d8b70be
Fingerprint 2d28d19239f549b1
Analysis status DONE
Considered CTI value 0
Text language
Published Nov. 16, 2017, 5:08 p.m.
Added to db Feb. 18, 2023, 1:18 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript
Title Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript
Detected Hints/Tags/Attributes 20/1/7
Source URLs
Redirection Url
Details Source https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-using-outlooks-createobject-method-and-dotnettojscript-a88a81df27eb
Details Redirection https://posts.specterops.io/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript-a88a81df27eb?gi=1327fc1052fb
Details Redirection https://posts.specterops.io/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript-a88a81df27eb?gi=22efcd95ce0e
Details Redirection https://posts.specterops.io/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript-a88a81df27eb?gi=63c6794ad9e4
Details Source https://posts.specterops.io/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript-a88a81df27eb?gi=c9738c7433fb
URL Provider
Details Provider Source level domain
Details medium.com medium.com
Details specterops.io posts.specterops.io
Attributes
Details Type #Events CTI Value
Details Domain 11 
enigma0x3.net
Details File 312 
calc.exe
Details File 173 
outlook.exe
Details File 1122 
svchost.exe
Details File 23 
vbscript.dll
Details File 29 
jscript9.dll
Details IPv4 1 
192.168.99.152