CertFixer MSI Execution Followed by Run Key Persistence

Kaung Khant Ko@kaungkhantko

•updated yesterday•3•0•3

Detects the execution of a fake certificate-fix MSI package via msiexec.exe or the creation of CertFixer.msi, followed within one hour by the creation of a Run key persistence mechanism named 'WindowsUpdateAssist' on the same device.