Technical Information
Malicious functions
Injects code into
the following user processes:
- msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\advancedrun.exe
- %TEMP%\msbuild.exe
Deletes the following files
- %TEMP%\advancedrun.exe
Network activity
Connects to
- 'ch####p.dyndns.org':80
- 'fr###eoip.app':443
TCP
HTTP GET requests
- http://ch####p.dyndns.org/
Other
- 'fr###eoip.app':443
UDP
- DNS ASK ch####p.dyndns.org
- DNS ASK fr###eoip.app
Miscellaneous
Creates and executes the following
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 3160
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir '%ALLUSERSPROFILE%\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 2908
- '%TEMP%\msbuild.exe'
