in cortado/rtas/exec_scripting_persistence_locations.py [0:0]
def main():
powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
log.info("Dropping executable to Startup Folder using powershell")
_ = _common.execute_command(
[
powershell,
"-C",
"Copy-Item",
"C:\\Windows\\System32\\cmd.exe",
"'C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\'",
]
)
log.info("Dropping executable to Startup Folder using powershell")
_ = _common.execute_command(
[
powershell,
"-C",
"Copy-Item",
"C:\\Windows\\System32\\cmd.exe",
"'C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd2.exe'",
]
)
_common.remove_files(
[
"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd2.exe",
"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\cmd.exe",
]
)