A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the ~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following message:
“You seem tense. Take a deep breath and relax!”
The incident response team is activated and opens the picture in a virtual machine to test it. After a short analysis, the following code is found in C:
Tempchill.exe:Powershell.exe CCommand “do {(for /L %i in (2,1,254) do shutdown /r /m Error! Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start-Sleep Cs 900) } while(1)”
Which of the following BEST represents what the attacker was trying to accomplish?
A . Taunt the user and then trigger a shutdown every 15 minutes.
B . Taunt the user and then trigger a reboot every 15 minutes.
C . Taunt the user and then trigger a shutdown every 900 minutes.
D . Taunt the user and then trigger a reboot every 900 minutes.
Answer: B
Leave a Reply