Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used <code>certutil -decode</code> to decode files on the victim’s machine when dropping UPPERCUT.