windows - Innovative Persistent Registry Entry Methods

Question

Prepping for a CEH certification test. My question goes along these lines:

Situation: When attempting to add persistence to Windows malware, if the programmer chooses not to use one of the many existing RUN, AUTORUN, RUNONCE, etc. Windows registry entries ...

Question: Can he create an entirely new registry entry similar to \HKLM\SOFTWARE\My_Rootkit_Program\RUN and have it run automatically ... simply because it's named RUN?

Follow-On Question: Is the "magic" (repeatability) inherent in all registry entries named "RUN", OR does Windows use a concept similar to a PATH variable to locate and run those entries in registries named RUN (or similar)?

Follow-On Observation: If this latter hypothesis is correct, it follows that meddling with that registry PATH statement would be an advanced technique allowing programmers to build persistence into backwater places with names like \HKLM\SOFTWARE\CLASSES\7z\Updated_Compression_Routines.

Please forgive me (1) if this has been asked before and my searches didn't find the Q&A string (2) or I've misused specific terms.

Thanks ... Allen.

Answer 1

不，您不能随心所欲地创建自己的 runkey。此处列出了有效的 runkeys 。当然，您还拥有HKLM\SYSTEM\CurrentControlSet\Control\...可用于在启动时启动驱动程序的服务密钥。这可以被 rootkit 使用，但通常恶意软件只会使用普通的 runkey（或者甚至将自己放在开始菜单的启动文件夹中）。

希望这可以帮助。