Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsAppCertificationLC] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsAppCertificationLC] 'ImagePath' = '%ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\WinRing0x64.sys'
Creates the following services
- 'WindowsAppCertificationLC' %ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\windows app certification kit\certification\appcertui.exe
- %WINDIR%\temp\__psscriptpolicytest_iasvh0x4.nwg.ps1
- %WINDIR%\temp\__psscriptpolicytest_grmfimio.rfy.psm1
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-09-647.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-09-963.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-065.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-328.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-362.dump
- %WINDIR%\temp\__psscriptpolicytest_2xph130u.uzv.ps1
- %WINDIR%\temp\__psscriptpolicytest_os0qlxvx.hva.psm1
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-594.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-625.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-679.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-779.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-895.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-10-965.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-080.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-127.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-152.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-202.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-271.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-302.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-333.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-769.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-807.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-838.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-870.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-892.dump
- %WINDIR%\temp\content\5016-1292-powershell.exe-14-18-11-986.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\pimpudzsjdmc.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_iasvh0x4.nwg.ps1
- %WINDIR%\temp\__psscriptpolicytest_grmfimio.rfy.psm1
- %WINDIR%\temp\__psscriptpolicytest_2xph130u.uzv.ps1
- %WINDIR%\temp\__psscriptpolicytest_os0qlxvx.hva.psm1
Network activity
Connects to
- 'po##.#ashvault.pro':443
- 'po####n.drpc.org':443
- 'pa###bin.com':443
- '45.##0.34.73':80
TCP
Other
- 'po####n.drpc.org':443
- 'pa###bin.com':443
- 'po##.#ashvault.pro':443
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK po####n.drpc.org
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\windows app certification kit\certification\appcertui.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' delete "WindowsAppCertificationLC"
- '<SYSTEM32>\sc.exe' create "WindowsAppCertificationLC" binpath= "%ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe" start= "auto"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "WindowsAppCertificationLC"
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '%WINDIR%\explorer.exe'
