hasherezade / persistence_demos

Demos of various (also non standard) persistence methods used by malware

persistence_demos

Demos for the presentation "Wicked malware persistence methods".

• com_hijack - loads a demo DLL via COM hijacking
• extension_hijack - hijacks extensions handlers in order to run a demo app while the file with the given extension is opened
• shim_persist - installs a shim that injects a demo DLL into explorer.exe
• restricted_directory - drops a PE into a restricted directory (that cannot be accessed or deleted), and launches it

persistence_demos's Issues

problem in converting cpp file to exe file

hi
I wanna converting cpp file to exe by gcc but this error had shown

"c:/users/o-philipo-res/downloads/gcc-12.2.0-no-debug/bin/../lib/gcc/x86_64-w64-mingw32/12.2.0/../../../../x86_64-w64-mingw32/bin/ld.exe: C:\Users\O-PHIL~1\AppData\Local\Temp\ccnbUZcf.o:main.cpp:(.text$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructIPKcEEvT_S8_St20forward_iterator_tag[_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructIPKcEEvT_S8_St20forward_iterator_tag]+0xc4): undefined reference to `std::__cxx11::basic_string<char, std::char_traits, std::allocator >::_M_set_length(unsigned long long)'
collect2.exe: error: ld returned 1 exit status"

irrelevant problem

hi
I found a method similar that way you provide for persistence via extension hijacking at the flowing address
https://github.com/cocomelonc/2022-08-26-malware-pers-9
this is how I implemented the method . first I made some change in the hack.cpp file so that it runs my sample code instead of the hack file, then I put the clean up code in the test malware file , in other words I created a bat file in which I did these things

my sample batfile that i executed insted of hack.exe

echo "hello world"
reg add "HKEY_CLASSES_ROOT\txtfile\shell\open\command" /ve /t REG_SZ /d "%SystemRoot%\system32\NOTEPAD.EXE %1

now , I have question , when I change registry by this code (reg add "HKEY_CLASSES_ROOT\txtfile\shell\open\command" /ve /t REG_SZ /d "%SystemRoot%\system32\NOTEPAD.EXE %1) but %1value not show in a registry and any txt file which I open it after that showed with untitled headers and I must change registry manually so that %1 inserted in key value to txt file showed correctly