~/bokkapig
hack the box machine writeups

AppCert.exe

type: OtherMSBinaries
Windows App Certification Kit command-line tool.

Full path

C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe

Commands

  1. ExecuteAdministrator T1127

    Performs execution of specified file, can be used as a defense evasion

    appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

    Execute an executable file via the Windows App Certification Kit command-line tool.

    os: Windows

    Execute: EXE

  2. ExecuteAdministrator T1218.007

    Execute custom made MSI file with malicious code

    appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}

    Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.

    os: Windows

    Execute: MSI

Resources

acknowledgement: Avihay Eldad @AvihayEldad