1) Checks if the user has Administrator privilege 2) Drops the Cobalt Strike Stager in debug or “%TEMP%” directory as “tmp_FlVnNI.dat” depending on the user privilege 3) Opens the decoy Word document 4) Locates the InstallUtil.exe and its installed version 5) Copies “schtasks.exe” to “%TEMP%” directory and renames it to “wtask.exe” 6) Creates Scheduled tasks with the name “Security Script kb00855787” 7) Renames “wscript.exe” into “winwsh.exe” 8) Runs the scheduled task to execute the Cobalt Strike Stager 9) C2 communication