Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
Modifies file system
Creates the following files
- C:\temp\mimic_decrypt.txt
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Network activity
Connects to
- 'ap#.msn.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0c##############
Other
- 'ap#.msn.com':443
UDP
- DNS ASK ap#.msn.com
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Decrypt tool'
Executes the following
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
