Category Archives: Forensic Analysis

Running programs via Proxy & jumping on a EDR-bypass trampoline, Part 4

Posted on by

Here’s yet another subclass of tricks one can use to distort the process tree seen by EDR and sandbox solutions.

Many Windows programs launch other internal Windows programs (native to OS). They do so carefully so they typically launch them from %SystemRoot%. Many of them use GetSystemDirectory to build a path, but there are still quite a few that rely on an environment variable – they need to use an ExpandEnvironmentStrings API to obtain the actual path.

Changing that environmental variable and copying the required files to a redirected location while replacing the target application enables us to launch a payload of choice making it look like it was executed by a signed binary.

Example:

In this old post I mentioned AtBroker. When you launch it from a command line without any arguments it will simply launch Narrator.exe.

We can:

  • create a test folder
  • change the SystemRoot to point to it
  • copy all the necessary files from the original system32 and Registration folder (procmon helps)
  • launch atbroker.exe
  • the narrator.exe payload will be executed

This launches C:\Test\System32\Narrator.exe:

Beyond good ol’ Run key, Part 67

Posted on by

New versions of Windows are shipped with an on-screen keyboard that – amongst other features – allows us to enter the text in a handwritten form:

The task of handwritten text analysis and input training is ‘outsourced’ to dedicated libraries that are loaded from the following locations in the Registry:

  • HKLM\SOFTWARE\Microsoft\TPG\System Recognizers
  • HKLM\SOFTWARE\Microsoft\TPG\Recognizers

Adding an entry that replaces an entry for e.g. English:


leads to the library being loaded anytime the TabTip.exe process is executed (one that presents the ‘tablet’ to handwrite on):

For what its worth, my test DLL broke the handwriting input as it doesn’t do any proxy work.

Probably not the most used feature on your desktop computer, but it could work on many tabletish computers in Asia where ideograms and other complex characters are commonly used (plus users use handwriting input a lot!).