{"id":1613,"date":"2013-01-19T10:47:24","date_gmt":"2013-01-19T10:47:24","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1613"},"modified":"2014-09-20T22:22:53","modified_gmt":"2014-09-20T22:22:53","slug":"beyond-good-ol-run-key-part-3","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2013\/01\/19\/beyond-good-ol-run-key-part-3\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 3"},"content":{"rendered":"

Possible Autostart\/start mechanisms that are built-in ‘natively’ in Windows and also available by means of extra features offered by many applications go beyond typical path locations and registry keys highlighted by popular programs and scripts like Autoruns<\/a> and SilentRunners<\/a>. I have covered some of the non-standard persistence techniques in 2 older posts in the series here<\/a> and here<\/a>, but as usual – there is always more to write about.<\/p>\n

In this post I will cover another batch of less known and possibly ‘obscure’ technique that could be potentially used for autostart\/start purposes. I write ‘obscure’, because it is not a typical way of doing autostart, but let’s be honest – there is nothing really extraordinary about it – just a simple abuse of built-in features in both OS and applications.<\/p>\n

Code-in-the-middle proxy<\/h3>\n

Long story short, it is a well known fact that many existing registry entries and files pointing to or containing code can be modified to introduce a code-in-the-middle proxy (DLL, EXE, etc.) that will be executed\/loaded first instead of a legitimate entry. The original entries are preserved so that they can be transparently executed\/loaded once malware is running. There are many existing examples of this technique already being used e.g. hijacks of Shell Open Command,\u00a0 Image File Execution Options , etc., but it is important to remember that this technique can be extended literally to any registry key or file that is loaded either during autostart or often used by users.<\/p>\n

Application Registration (App Paths) hijacking<\/h3>\n

Another proxy technique that could be used to hijack popular applications relies on registry entries stored under the following key:<\/p>\n

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths<\/p>\n

As per Microsoft<\/a>:<\/p>\n

The entries found under App Paths are used primarily for the following purposes:<\/p>\n