Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 683245">Recently I came across a sample which hijacked the value of Userinit (REG_SZ) under the Winlogon key (REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon).<img src="https://snag.gy/X0pwCe.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" />You can append to the string present as the value to make another application start-up at boot. For example, changing it to &quot;C:\Windows\system32\userinit.exe, C:\hello.exe&quot; would cause both userinit.exe and hello.exe to start-up at boot. The method has been known for a long time though, it is nothing new - you would also require elevation to do this due to where the registry key is located (HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER).There are many alike tricks to gain persistence at boot without touching scheduled tasks, the start-up folder or the Run/RunOnce key. Another example would be hijacking of a DLL used by vulnerable software.</blockquote>

[QUOTE="Deleted member 65228, post: 683245"] Recently I came across a sample which hijacked the value of Userinit (REG_SZ) under the Winlogon key ([B]REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon[/B]). [IMG]https://snag.gy/X0pwCe.jpg[/IMG] You can append to the string present as the value to make another application start-up at boot. For example, changing it to "C:\Windows\system32\userinit.exe, C:\hello.exe" would cause both userinit.exe and hello.exe to start-up at boot. The method has been known for a long time though, it is nothing new - you would also require elevation to do this due to where the registry key is located (HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER). There are many alike tricks to gain persistence at boot without touching scheduled tasks, the start-up folder or the Run/RunOnce key. Another example would be hijacking of a DLL used by vulnerable software. [/QUOTE]

Verification