2 Crucial Registry Keys For DFIR

Intro

Suppose, a cyber criminal group has compromised a bank's whole computer

system. Now, you are an incident responder. You found a PC, which has some

opened or running programs. Those programs are known as legitimate

(i.e. notepad.exe). Now, the question is- will you close those programs?

Let's jump into the answer.

Registry Keys

I know- you won't believe any process, which are running on a compromised

system. Even if, it is a well-known legitimate process i.e. notepad.exe.

Because, malware can inject malicious code to another legitimate process

(or, inject shellcode  at the entrypoint of a DLL) and then execute that code.

But, suppose the malware has not injected code to any of the opened programs.

So now, is it safe to close the opened programs? No, it's not safe in some cases.

But, why? Okay, first see the below cmd commands-

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\

Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD

/d 512

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\

SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\

SilentProcessExit\notepad.exe" /v MonitorProcess /d

"C:\Users\Admin\malware.exe"

If an attacker run the above 3 commands with Administrative privilege then,

whenever you will close the opened notepad.exe, the malware.exe will be

executed. Even, the more dangerous thing is that, attacker can first enumerate

opened programs and then, run the above commands for those opened program

(by simply replacing 'notepad.exe' with the opened program's executable name).

So, closing programs without checking these registry keys may result bad.

Attacker can also add command line arguments after the executable name.

More info about these registry keys will be found at HERE.

In addition, the above used registry key can be used for another purpose.

The registry key is- "HKLM\SOFTWARE\Microsoft\Windows NT\

CurrentVersion\Image File Execution Options". Attacker will have to

simply run the below cmd command-

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image

File Execution Options\notepad.exe" /v Debugger /t REG_SZ /d cmd.exe

Now, whenever you will open the notepad.exe, the cmd.exe will run

(as a debugger). Attacker can write malicious executable's name in place

of cmd.exe and also add command line arguments.

Summary

In an incident response operation, you may get some still-opened programs.

But, attackers can take advantage of registry keys to run a malicious program,

as soon as the opened program is closed. So, closing an opened program can

give a bad result. Further more, opening any program in a compromised system

can also give a quite similar result. So, an investigator should be aware of that.

**********************************************************************************

CHECK OUT (#1 Youngest Certified Ethical Hacker YouTube Channel) To Learn Hacking For FREE: CLICK HERE

Thanks and Regards,

Shubham Yadav

(Information Systems Security Professional)