Technical Information
Modifies file system
Creates the following files
- %TEMP%\ckz_gby7\autodeployer.exe
- %TEMP%\ckz_gby7\autodeployer.exe.config
- %TEMP%\ckz_gby7\autdeploysettings.xml
- %TEMP%\cherwell client.exe
- %TEMP%\cherwell client.msi
Network activity
Connects to
- 'fs#####.#herwellondemand.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'fs#####.#herwellondemand.com':443
UDP
- DNS ASK fs#####.#herwellondemand.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '%TEMP%\ckz_gby7\autodeployer.exe' https://FSCtest.cherwellondemand.com//CherwellAutoDeploy
- '%TEMP%\cherwell client.exe'
Executes the following
- '<SYSTEM32>\msiexec.exe' /package "%TEMP%\Cherwell Client.msi"
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI869C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1018078 1 CCIUtilities!CCIUtilities.CustomActions.CheckCrossProduct
