Bitter PapRAT: cmd from explorer opens XLS lure and silently runs MSI

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•4

Detects a suspicious execution chain where a LNK file executed from a mounted VHDX launches cmd.exe, opening a decoy .xls/.xlsx file while simultaneously launching a silent MSI installation using msiexec.