In this demo, we are going to analyze the registry run keys,
which can also be used by attackers to maintain persistence on a system.
Adding an entry to the run keys will cause the malware to be
executed when a user logs on to the system.
Registry run keys is a very popular technique to achieve persistence on a
compromised Windows system. MITRE ATT&CK classifies registry run keys as part of
the boot or logon autostart execution technique. Adding an entry to the registry
run keys will cause the malicious program to be executed when the user logs in,
and thus maintains persistence even after the system reboots. We have to note
that this is not a vulnerability in Windows, but is actually abuse of system
features as the registry run keys are designed to execute programs during login,
and detecting these techniques is not very difficult as the registry needs to be
checked for any changes to the run keys by any malicious programs.
For this,
you need to be aware of the location of the run keys within the
Windows registry, and that is not an easy task as there are a number
of registry run key locations. But again,
RegRipper comes to our rescue with another great plugin simply called run.
So let's go back to the demo environment and go to the plugins directory here.
Now let's open the run plugin.
Here, it shows that this plugin can use two registry hives, Software and
NTUSER\.DAT. And here these are all the possible locations for the registry
run keys within the Software hive. And for the NTUSER hive, these are all
the possible locations for the run keys.
As you can see, that's a huge number of registry keys,
but since we are using RegRipper, there is no need to memorize these locations.
Now let's go ahead and execute this plugin. First, we'll use
the SOFTWARE hive and the plugin, run.
So this is the output. Here, it looks for all of the 12 run
keypads in the Software hive and lists the values and subkeys
along with their LastWrite Time.
Most of the run keys are not found.
That means they do not exist on the system we are analyzing. So
we can see here, there are a few entries in this run key,
Microsoft\Windows\CurrentVersion\Run, but nothing suspicious here.
As we can see, all of the entries are genuine program locations.
So now let's go ahead and execute the plugin on
NTUSER.DAT hive and then the same plugin, run.
So again, we have similar output, and these are all of the 14
possible locations from the NTUSER registry hive.
Again, most of the run keys do not exist,
but here we have a few entries in this run key,
Software\Microsoft\Windows\CurrentVersion\Run.
The second entry here is very interesting.
As you can see,
the program name is Updater, but it is actually invoking powershell.
And not just that, we can see that the payload location is also supplied. So the
payload for PowerShell will be present in this registry key mentioned here,
HKCU:Software\Microsoft\Windows\CurrentVersion Debug.
That means all of the commands to be executed by PowerShell
will be present in this registry key.
So this is a clear indication of system compromise. And from experience,
I can say that the attacker has used a popular retaining
tool called Empire. One of the post exploitation modules
in Empire is called UserLAnd,
and it uses registry run keys as a persistence mechanism,
which is what has happened here.
So the next logical step for analysis would be to go ahead and
analyze the PowerShell payload in the debug key and look for
any IP addresses of the attacker,
but that is out of scope for RegRipper and this course.