I was pretty surprised to find this one as I have looked at kernel32.dll many times before. Seeing a code branch that is responsible for enumerating registry subkeys and loading the DLLs, and one that has not been discussed before, is a rare treat so it immediately found its way to this series…

The actual code resides inside the NotifyUILanguageChange API. Despite MS claiming that it is unsupported it is still being used internally by a number of components. Chances for it to go away soon are probably low. As far as I can tell, the function in question is called when certain system settings are changed – I will show you how to trigger it in a second 🙂

The code enumerates entries under this Registry key:

• HKLM\System\CurrentControlSet\
  Control\MUI\CallbackDlls\
  {ENTRY}\DllPath=<DLL>

On Windows 7, we can see a number of these entries:

and Windows 10 has even more – I really doubt this code is going away:

Each entry includes the DllPath that points to a library. The only requirement is that all these libraries must be signed…

Now, how to trigger it?

It’s simple: just change the system locale…

Once you do that, you can observe Procmon log showing the enumeration:

Again, the exact criteria when the DLLs are loaded and how are not clear to me, and there may be other times when the code is triggered, but finding these out is a homework exercise for the reader 😉

It’s certainly not the best persistence mechanism, but yet another place to look at, just in case…