登录查看更多内容

What are the common characteristics and indicators of compromise of malware that abuses autorun and run keys?

由人工智能和领英社区提供技术支持

Malware that abuses autorun and run keys is a common and persistent threat to Windows systems. Autorun and run keys are registry entries that allow programs to execute automatically when a device is connected or a user logs on. Malicious actors can use them to launch malware, bypass security controls, and maintain persistence on compromised hosts. In this article, you will learn about the common characteristics and indicators of compromise of malware that exploits these features, and how to detect and remove them from your system.

此文章中的业界达人

由社区从 7 条内容中精选。了解更多

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate…

1 Autorun keys

Autorun keys are registry entries that specify the actions to take when a removable device, such as a USB drive or a CD-ROM, is inserted into the system. They are located under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run subkeys. Malware can use these keys to execute itself or other malicious files when a device is connected, or to trick users into opening infected files by modifying the autorun.inf file on the device. Some examples of malware that use autorun keys are Conficker, Stuxnet, and Ransom:Win32/Cerber.

添加您的观点

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate | Speaker | Writer
举报内容
Malware that abuses autorun and run keys often exhibits specific characteristics and leaves behind indicators of compromise (IoCs) that can be used to detect and analyze its presence. Autorun and run keys are mechanisms in Windows that allow programs to automatically run when a user logs in or when certain events occur. Detection and analysis of these characteristics and indicators can aid in identifying and mitigating the impact of malware abusing autorun and run keys. Automated threat detection solutions and continuous monitoring of systems are crucial for early detection and response. Additionally, threat intelligence feeds can help in staying updated on emerging threats associated with autorun and run key abuse.

已翻译

赞

2 Run keys

Run keys are registry entries that specify the programs to run when a user logs on to the system. They are located under the same subkeys as autorun keys, as well as under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce subkeys. Malware can use these keys to launch itself or other malicious components every time a user logs on, or to run once and delete itself after execution. Some examples of malware that use run keys are Emotet, TrickBot, and Zbot.

添加您的观点

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate | Speaker | Writer
举报内容
Collection of Indicators of Compromise (IoCs) from Run keys in the Windows Registry involves identifying suspicious or malicious entries that may indicate the presence of malware or unauthorized programs configured to run automatically. The Run keys are specific registry entries where programs are set to execute upon user login or system startup. Use automated tools to streamline the collection process. Tools like Sysinternals Autoruns or various script-based solutions can help identify suspicious entries. Explore scripting or automation solutions to regularly collect and analyze Run key entries across multiple systems.

已翻译

赞
Caique B.

Threat Intelligence Specialist | CEH | Digital Forensics and Incident Responder (DFIR) | CTI backend | Malware Analyst | Malicious Infrastructure Hunter | MISP | Ransomware Group Hunter | Teacher and Speaker.
举报内容
Identificar fun??es específicas durante a execu??o de uma amostra é crucial, vide as opera??es de fun??es da API do Windows que realizam as modifica??es das chaves de registros do Windows. Monitore-as durante uma análise dinamica e será possível identificar quais delas s?o alteradas.

已翻译

赞

3 Characteristics of malware that abuses autorun and run keys

Malware that exploits autorun and run keys usually displays a range of characteristics, including creating or modifying registry entries with random or misleading names or values, copying itself or other malicious files to removable devices, system folders, or temporary directories with hidden or system attributes or file extensions, using obfuscation, encryption, or packing techniques to avoid detection by antivirus or anti-malware software, communicating with remote servers or peers to get commands, download updates, or exfiltrate data, and performing malicious activities like stealing credentials, encrypting files, installing backdoors, or spreading across other systems.

添加您的观点

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate | Speaker | Writer
举报内容
Malware that abuses autorun and run keys typically exhibits certain characteristics and behaviors to achieve persistence on a system. The autorun and run keys in the Windows Registry are common targets for malware seeking to execute automatically during system startup or user logon. Malware modifies specific registry keys associated with autorun and run entries. They can be persistence Adds entries to autorun or run keys to ensure the malware runs every time the system starts or a user logs in. Malware may engage in DLL side-loading to execute malicious code.

已翻译

赞

4 Indicators of compromise of malware that abuses autorun and run keys

Indicators of compromise of malware that abuses autorun and run keys may include unusual or suspicious registry entries under the autorun and run subkeys, especially if they point to unknown or unusual files or locations. Unusual or suspicious files on removable devices, system folders, or temporary directories may also be a sign of compromise, particularly if they have hidden or system attributes or file extensions. Other indicators can be unusual or suspicious network traffic, such as connections to unknown or malicious domains or IP addresses, or unusual protocols or ports. Additionally, high CPU or memory usage, slow performance, pop-ups, alerts, or errors may be signs of malicious activity. Unusual user behavior such as opening unknown or unexpected files, entering credentials on unfamiliar sites, or clicking on suspicious links can also be an indicator of compromise.

添加您的观点

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate | Speaker | Writer
举报内容
You should look for presence of executable files in non-standard or unexpected directories, file names that resemble legitimate system processes but are located in unusual paths, using names like "svchost.exe" or "explorer.exe" in non-standard locations. Outbound connections to known malicious domains or IP addresses, some entries with obfuscated or encoded values, such as Base64-encoded or encrypted command-line parameters within the registry entries. Detection and response to malware abusing autorun and run keys require a combination of automated tools, continuous monitoring, and manual analysis.

已翻译

赞

5 Detection and removal of malware that abuses autorun and run keys

To detect and remove malware that abuses autorun and run keys, a combination of tools and techniques must be used. This includes antivirus or anti-malware software to scan the system and removable devices for known malware signatures or anomalies. Autorun analysis tools, such as Autoruns, AutoRunsC, or USBDeview, can inspect and disable the autorun and run registry entries and autorun.inf files on the removable devices. Registry analysis tools, like Regshot, RegScanner, or Process Monitor, can monitor and compare changes in the registry before and after inserting a removable device or logging onto the system. File analysis tools like FileAlyzer, PEiD, or VirusTotal can be used to examine and identify files associated with the autorun and run registry entries or autorun.inf files on removable devices. Network analysis tools like Wireshark, TCPView, or Netstat can capture and analyze network traffic generated by the malware or removable devices. System analysis tools such as Process Explorer, Process Hacker, or Task Manager can be used to identify and terminate processes related to the malware or removable devices. Manual methods may also be employed to remove the malware and its traces from the system; this includes deleting malicious files and registry entries, restoring from a backup, or reinstalling the operating system.

添加您的观点

Filipi Pires

Global Threat Researcher and Cybersecurity Advocate at senhasegura | Snyk Ambassador | Hacking Is Not a Crime Advocate | Speaker | Writer
举报内容
Detecting and removing malware that abuses autorun and run keys requires a combination of security tools, best practices, and manual analysis, you can use some tools such as: - Antivirus scanning: VirusTotal and MalwareBazaar - Sysinternals Autoruns - Sysinternals Process Explorer - Antivirus solutions - Malware analysis tools: DIE, PEiD and FileAnalyzer - Networking Tools. Remember that no single tool or approach is foolproof, and a combination of tools, best practices, and user awareness is essential for effective malware detection and removal.

已翻译

赞
Ayoub Khlifi

Cyber Security Engineer || Data Scientist (MSc)
举报内容
In general, There are 2 approaches to utilize for threat detection along with SIEM or SOAR implantation: Deterministic: relies on fixed rules such as presence of well defined signatures, 5 tuples... Probalistic: relies on behavioral analysis such as setting up a baseline of normal system behaviour and any deviation from that triggers alerts.

已翻译

赞

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Malware Analysis

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the common characteristics and indicators of compromise of malware that abuses autorun and run keys?

1

2

3

4

5

6

1 Autorun keys

2 Run keys

3 Characteristics of malware that abuses autorun and run keys

4 Indicators of compromise of malware that abuses autorun and run keys

5 Detection and removal of malware that abuses autorun and run keys

6 Here’s what else to consider

Malware Analysis

给文章评分

感谢您的反馈

更多Malware Analysis相关文章

更多相关阅读内容