Beyond good ol’ Run key, Part 115

September 13, 2019 in Anti-Forensics, Autostart (Persistence)

This is yet another episode of “I think I am right, but I have not tested it”. I don’t have the hardware to do it, but I do have information that suggests it should work.

It’s nearly Saturday, so we should talk about cats. And one cat in particular has a potential meaning in the persistence universe: a cougar.

The following Registry entries point to a settings.dll library. I suspect that if you have Cougar software installed, these entries exist and are utilized by the supporting software. Aka if you point these settings to a different DLL, you may achieve a man-in-the-middle persistence.

  • HKLM\SOFTWARE\Cougar\GamingDevice\250M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\300M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\400M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\450K\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\450M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\500K\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\500M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\530M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\550M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\600M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\700K\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\700M\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\AttackX3\Dll\String=setting.dll
  • HKLM\SOFTWARE\Cougar\GamingDevice\Revenger\Dll\String=setting.dll

I would appreciate if you could test it, if you have the aforementioned software installed. Thank you.

Beyond good ol’ Run key, Part 114

September 7, 2019 in Anti-Forensics, Autostart (Persistence)

Ability to extend AutoPlay functionality with dedicated handlers is well-known and documented. The Registry key shown below is where these get added:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\AutoplayHandlers\Handlers\

Instead of describing this persistence mechanism in detail, I will focus on a slightly different aspect.

Lots of software out there registers their own “personalized” handlers. While such software may no longer be used today too frequently it still comes pre-installed on many laptops and workstations.

One could modify these existing handlers to redirect them to a malicious component. How to find these? There are at least two ways. Use a predefined list, or enumerate all handlers and find these that point to handlers that reside within Program File directory (with an exclusion for Media Player).

The second task is trivial, and the first task is not too difficult either. Looking at installers of media burning software one can quickly find a lot of candidates:

  • AntsDVDDVDMovieOnArrival
  • ASHAshampoo_Burning_Studio_12BURNONARRIVAL
  • ASHAshampoo_Burning_Studio_12COPYONARRIVAL
  • ASHAshampoo_Burning_Studio_12RIPONARRIVAL
  • ASHAshampoo_Burning_Studio_2013BURNONARRIVAL
  • ASHAshampoo_Burning_Studio_2013COPYONARRIVAL
  • ASHAshampoo_Burning_Studio_2013RIPONARRIVAL
  • ASHAshampoo_Burning_Studio_6_FREEBURNONARRIVAL
  • ASHAshampoo_Burning_Studio_6_FREECOPYONARRIVAL
  • ASHAshampoo_Burning_Studio_6_FREERIPONARRIVAL
  • AVSCaptureVideoCameraArrival
  • BBShowPictureEventHandler
  • BlindWriteAutoplay_741406
  • BurnAware
  • CCShowPicturesOnArrival
  • CDBurnerXP
  • CopyToDVDAutoplay_741406
  • daccdrip
  • DVDClonerBackupDVDMovieOnArrival
  • dvdXsoftRipDVDMovieOnArrival
  • ExsateDVCLHandler
  • ExsateVideoExpressHandler
  • HeliconBurnerOnArrival
  • HMMAddToDatabaseHandler
  • HMMMTPHandler
  • HMMPlayHandler
  • HMMRipAudioCDHandler
  • JoyceCD
  • LightImageResizerAutoplay_741406
  • MagicBurnStudioOpenHandler
  • MPCPlayBluRayOnArrival
  • MPCPlayCDAudioOnArrival
  • MPCPlayDVDMovieOnArrival
  • MPCPlayMusicFilesOnArrival
  • MPCPlayVideoFilesOnArrival
  • P2GCDBurningOnArrival
  • P2GDVDBurningOnArrival
  • PicsPrintAutoplay
  • PIETransfer
  • PlayWithBlazeDVD
  • PlayWithDVDXPlayer
  • Power2GoPlayCDAudioOnArrival
  • PrintstationPrint
  • PStarterBlankCDArrival
  • PStarterDVDBurningOnArrival
  • PStarterMixedCDArrival
  • PStarterMusicFilesArrival
  • PStarterPicturesArrival
  • PStarterVideoFilesArrival
  • S4BCaptureVideoCameraArrival
  • SpybotScanFiles\
  • VCUPlayDVDMovieOnArrival
  • VMP1PlayBluRayMovieOnArrival
  • VMP1PlayDVDMovieOnArrival
  • VMP1PlayMusicFilesOnArrival
  • VMP1PlayVideoFilesOnArrival

Of course, such persistence method could be only used as a Plan B. After all, who is still burning CDs today…