Hexacorn | Blog Hexacorn

Links to post series

July 2, 2015 in Hexacorn

ximad pinged me asking if I can make some of the content more readable – I will think of it and perhaps convert some of this stuff into a PDF, but in the mean time providing a series of links for the ‘longer’ series on the blog

Beyond good ol’ Run key

Beyond good ol’ Run key

https://www.hexacorn.com/blog/2012/07/23/beyond-good-ol-run-key/

A large number of different, more and less known mechanisms described – firts part of the series and as such, quite a big post
ICQ
- HKCU\Software\Mirabilis\ICQ\Agent\Apps
Standard apps that contain functionality / options to launch mandatory programs(P2P apps, etc.)
‘Scanning’ files with AV when downloaded
Windows Shell alternatives
AutoStart when Scanner button is pressed
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\AutoplayHandlers\Handlers
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\StillImage\Registered Applications
- HKLM\SYSTEM\CurrentControlSet\Control\StillImage\Events\STIProxyEvent
Autostart by re-using existing autostart entries
Autostart via Plugins
File System infection

Beyond good ol’ Run key, Part 2

https://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/

Focused on standard apps that contain functionality / options to launch mandatory programs (Archivers, downloaders, Messengers, etc.) and the functionality is related to external viewers, AV scanners
- WinRar
  - HKCU\Software\WinRAR\Viewer\ExternalViewer
  - HKCU\Software\WinRAR\VirusScan\Name
- WinZip
  - HKCU\Software\Nico Mak Computing\WinZip\programs\zip2exe
  - HKCU\Software\Nico Mak Computing\WinZip\programs\viewer
  - HKCU\Software\Nico Mak Computing\WinZip\programs\vviewer
  - HKCU\Software\Nico Mak Computing\WinZip\programs\arc
  - HKCU\Software\Nico Mak Computing\WinZip\programs\arj
  - HKCU\Software\Nico Mak Computing\WinZip\programs\lha
  - HKCU\Software\Nico Mak Computing\WinZip\programs\scan
  - HKCU\Software\Nico Mak Computing\WinZip\programs\viewer
  - HKCU\Software\Nico Mak Computing\WinZip\programs\zip2exe
- Internet Download Manager
  - HKCU\Software\DownloadManager\VScannerProgram
- Download Accelerator Plus (DAP)
  - HKCU\Software\SpeedBit\Download Accelerator\AntiVirusEXE
- Orbit Downloader
  - %USERPROFILE%\Application Data\Orbit\conf.dat%USERPROFILE%\Application Data\Orbit\conf.dat
- Windows Live Messenger
  - HKCU\Software\Microsoft\MSNMessenger\AntiVirus
- Miranda
  - %USERPROFILE%\Application Data\Miranda\PROFILEFOLDER\PROFILEFILENAME.dat

Beyond good ol’ Run key, Part 3

https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/

Code-in-the-middle proxy
Application Registration (App Paths) hijacking
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
Text Services (TSF)
DLL load order
IIS Server Extensions (ISAPI filters)
AppCertDlls
- HKLM\CurrentControlSet\Control\Session Manager\AppCertDlls

Beyond good ol’ Run key, Part 4
https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/

Hijacking debuggers
- Standalone Debugger (32- and 64- bit)
  - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
  - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug
- NET Debugger (32- and 64- bit)
  - HKLM\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
  - HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
- Script Debugger
  - HKCR\CLSID\{834128A2-51F4-11D0-8F20-00805F2CD064}\LocalServer32\@
Hijacking Process Debug Manager
- HKLM\SOFTWARE\Classes\CLSID\{78A51822-51F4-11D0-8F20-00805F2CD064}\InprocServer32\@
ServiceDll Hijack
- ServiceDll parameter under HKLM\SYSTEM\CurrentControlSet\Services\
Mapi32 Stub Library
- HKLM\Software\Clients\Mail::(default)\DLLPath
- HKLM\Software\Clients\Mail::(default)\DLLPathEx
Hijacking Client executables
- HKLM\Software\Clients\ f.ex.
  - HKLM\SOFTWARE\Clients\Mail\Windows Mail\InstallInfo\HideIconsCommand
  - HKLM\SOFTWARE\Clients\Mail\Windows Mail\InstallInfo\ReinstallCommand
  - HKLM\SOFTWARE\Clients\Mail\Windows Mail\InstallInfo\ShowIconsCommand
Windows 2000 Welcome
- C:\WINNT\Welcome.exe via
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\tips\Show

Beyond good ol’ Run key, Part 5
https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/

A number of Phantom DLLs that are loaded as code via LoadLibrary variants, but not present on a system in its default install

Beyond good ol’ Run key, Part 6
https://www.hexacorn.com/blog/2014/01/10/beyond-good-ol-run-key-part-6-2/

Visual Basic persistence via
- HKLM\SOFTWARE\Microsoft\VBA\Monitors

Beyond good ol’ Run key, Part 7
https://www.hexacorn.com/blog/2014/02/09/beyond-good-ol-run-key-part-7/

Oasys (Office Automation System) loading %windir%\system32\BTLOG.DLL via
- HKLM\SOFTWARE\Microsoft\OASys\OAClient

Beyond good ol’ Run key, Part 8
https://www.hexacorn.com/blog/2014/02/21/beyond-good-ol-run-key-part-8-2/

Persistence via Jumplists, including Multiple Link functionality that launches more than one application with one click

Beyond good ol’ Run key, Part 9
https://www.hexacorn.com/blog/2014/03/02/beyond-good-ol-run-key-part-9/

Persistence via Pinned Apps pointing to malicious components

Beyond good ol’ Run key, Part 10
https://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/

HKCU\Software\Microsoft\Office Test\Special\Perf (used by Sofacy)
WWLIBcxm.DLL proxy loaded via
- HKCU\Software\Microsoft\Office\14.0\Word

Beyond good ol’ Run key, Part 11
https://www.hexacorn.com/blog/2014/04/27/beyond-good-ol-run-key-part-11/

Added large repository of autoruns mechanisms
- http://gladiator-antivirus.com/forum/index.php?showtopic=24610
Persistence via modified Environment variables (permanently set inside the Registry)
- HKCU\Environment

Beyond good ol’ Run key, Part 12
https://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/

Beyond good ol’ Run key, Part 13
https://www.hexacorn.com/blog/2014/06/18/beyond-good-ol-run-key-part-13/

Beyond good ol’ Run key, Part 14
https://www.hexacorn.com/blog/2014/07/08/beyond-good-ol-run-key-part-14/

Beyond good ol’ Run key, Part 15
https://www.hexacorn.com/blog/2014/08/04/beyond-good-ol-run-key-part-15/

Beyond good ol’ Run key, Part 16
https://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/

Beyond good ol’ Run key, Part 17
https://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/

Beyond good ol’ Run key, Part 18
https://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/

Beyond good ol’ Run key, Part 19
https://www.hexacorn.com/blog/2014/12/04/beyond-good-ol-run-key-part-19/

Beyond good ol’ Run key, Part 20
https://www.hexacorn.com/blog/2015/01/01/beyond-good-ol-run-key-part-20/

Beyond good ol’ Run key, Part 21
https://www.hexacorn.com/blog/2015/01/03/beyond-good-ol-run-key-part-21/

Beyond good ol’ Run key, Part 22
https://www.hexacorn.com/blog/2015/01/06/beyond-good-ol-run-key-part-22/

Beyond good ol’ Run key, Part 23
https://www.hexacorn.com/blog/2015/01/09/beyond-good-ol-run-key-part-23/