Beyond good ol’ Run key, Part 125

Been awhile since I posted in this series, so here comes a new trick.

It is not your typical executable for sure, change.exe that is. When I looked at it for the first time I was perplexed — within first few lines of code it literally executes other executables. Must be something good I thought, and good it was indeed.

When launched, change.exe does something very strange – it enumerates Registry entries under this location:

• HKLMSystemCurrentControlSetControlTerminal ServerUtilitieschange

These entries are … interesting, because they look like some stringified flags followed by executable names. Possible abuse opportunity?

When you run ‘change /?’ you get the following help information:

CHANGE { LOGON | PORT | USER }

Do you see the pattern? — no? look at these Registry entries again.

In my first attempt I added ‘foo|0 1 NOTEPAD notepad.exe’:

I then ran ‘change notepad’ and … notepad executed.

Now, if you paid attention there are other registry keys listed on the first screenshot:

change -> change.exe 
query -> query.exe 
reset -> reset.exe

They all follow the same pattern and fetch command list from Registry!

So you can either add a new entry, or modify an existing one. Access rights are in place and the key is owned by TrustedInstaller, but… well… once on the box, always on the box.

Last, but not least – it’s a persistence mechanism and a LOLBIN in one.

Read More

https://www.malwaredevil.com/2020/07/30/beyond-good-ol-run-key-part-125/?utm_source=rss&utm_medium=rss&utm_campaign=beyond-good-ol-run-key-part-125