A concrete case of Windows malware persistence: a seemingly harmless binary, overly broad permissions, and a forgotten registry key. Here's the analysis.
🧱 The Windows Registry: attackers' gold mine
To understand this attack, you first need to master the Windows Registry. It's the system's brain: a massive database holding every setting, from the wallpaper to critical services.
🦠 The persistence mechanism
The attacker used a classic but effective technique: Run keys. By placing an executable under the HKEY_LOCAL_MACHINE (HKLM) branch, the malware guarantees it gets launched every time a user logs in.
The critical detail: the file was hidden at C:\Users\Public\calc.exe. Why there? Because, by default, permissions in public folders are often too permissive. In this case, the Users group had full control (Full Control).
🛡️ Remediation: cleaning up and hardening
Cleanup alone isn't enough — you also have to close off the conditions that allowed the infection in the first place. Three lines of remediation:
- Remove the malicious registry key and its associated binary.
- Restrict permissions with
icacls: a standard user shouldn't be able to drop or modify executables in shared folders. - Enable auditing via
auditpolto catch any future modification of system files before it turns into an incident.
💡 Key takeaways
Security doesn't stop at antivirus. Poor file-permission management combined with a forgotten registry key can turn a minor vulnerability into a major backdoor.
Stay curious, stay secure.