{"id":6530,"date":"2019-07-12T20:52:22","date_gmt":"2019-07-12T20:52:22","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6530"},"modified":"2019-07-12T20:52:24","modified_gmt":"2019-07-12T20:52:24","slug":"beyond-good-ol-run-key-part-109","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/07\/12\/beyond-good-ol-run-key-part-109\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 109"},"content":{"rendered":"\n

This is probably the least practical persistence mechanism I came across. This is because as far as I know loading external DLLs into Metro apps requires a lot effort<\/a> (file need to be signed, have special rights, be included in a manifest, etc. — see the linked post for more details). In other words, it is practically impossible, unless there is some newer research that I missed. And in any case, even if we managed to load that DLL it would end up inside a process space of a low privilege app.<\/p>\n\n\n\n

However… always good to document it. Especially that this is about a close cousin of old Office Test<\/a> key I covered in 2014 & I think it’s my first Metro persistence trick.<\/p>\n\n\n\n

When you run the Mail program that is built-in windows 10 you are actually running a Metro app HxOutlook.exe<\/em> that executes from the following location:<\/p>\n\n\n\n

C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_16005.11425.20190.0_x64__8wekyb3d8bbwe\\HxOutlook.exe<\/p><\/blockquote>\n\n\n\n

If you look at the Process Monitor logs collected during this app start-up you will notice that the app tries to read the following key:<\/p>\n\n\n\n

\\REGISTRY\\…\\LocalState\\HKEY_CURRENT_USER\\Software\\Microsoft\\Office Test\\Special\\PerfImm<\/p><\/blockquote>\n\n\n\n

Of course, when I saw it, I immediately thought of my old post, because the key name looks so similar. <\/p>\n\n\n\n

Now, the Registry entry shown above may be a bit confusing. It is HKCU location, but since this is a Metro app you won’t find these entries inside your user hive. Instead, you will need to look for a small, app-dedicated hive placed in the following location:<\/p>\n\n\n\n

c:\\Users\\<user>\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat<\/p><\/blockquote>\n\n\n\n

The rule of a thumb is that if you see LocalState in a Registry entry, it means it’s a app hive.<\/p>\n\n\n\n

In order to modify it, you need to:<\/p>\n\n\n\n