cyber.hendryadrian.com
Security Insights · huntress.com

Testing Whether AUTOEXEC.BAT Can Still Enable Persistence on Windows

· Original article ↗

Summary

A Huntress experiment found no evidence that restoring the ParseAutoexec registry value makes Windows 7 or 10 parse AUTOEXEC.BAT. The author notes the test is not conclusive and points to registry-based persistence mechanisms still in use.

Key points

  • AUTOEXEC.BAT historically ran commands at startup or user logon, but the feature was later deprecated.
  • The author restored the ParseAutoexec value in machine and user registry hives and used ProcMon boot logging to look for file access or registry queries.
  • The test returned no matching results, suggesting the registry value alone does not revive AUTOEXEC.BAT parsing.
  • The author cautions that the experiment is not conclusive and that further reverse engineering would be needed to confirm the feature is fully inactive.
  • The article says legacy WIN.INI Load= and Run= behavior and SYSTEM.INI Shell= functionality have corresponding registry locations that malware continues to abuse.

Article Details

Topic
Testing whether Windows 7 and Windows 10 still parse AUTOEXEC.BAT at startup or logon and examining the persistence functions that replaced legacy startup files.

People

AdamIdentified as @Hexacorn; published research on bypassing Autoruns, which motivated the author’s investigation.Adam KofordCreated the artwork linked in the article; not materially involved in its technical research.SebdravenCredited with a blog about Goblin Panda actors abusing registry-based persistence.

Threat Actors

Goblin PandaThe article says Goblin Panda actors were recently caught abusing registry values corresponding to WIN.INI's Load= and Run= parameters for persistence.

Malware

Pikachu wormOne of the classic examples of this was the Pikachu worm which spread by email and overwrote AUTOEXEC.BAT to delete Windows’ critical system files:

Vendors

MicrosoftHowever, Microsoft has a long history of backwards compatibility and I couldn’t help explore whether Windows could be coaxed into still parsing this file.

Products

AUTOEXEC.BATHomeBlogFailing to Revive AUTOEXEC.BAT on Windows 7 & 10AutorunsHis recent blog highlighting his failure to bypass Autoruns with the AutorunsDisabled functionality was my motivation for this.CONFIG.SYSAs you can imagine, this functionality — along with similar files like WIN.INI, SYSTEM.INI, and CONFIG.SYS — were commonly abused by nefarious actors.Microsoft WindowsHomeBlogFailing to Revive AUTOEXEC.BAT on Windows 7 & 10ProcmonAfter adding the value to HKLM and the user specific HKU hive, I configured ProcMon to start logging at boot-up with the “Enable Boot Logging” option.SYSTEM.INIAs you can imagine, this functionality — along with similar files like WIN.INI, SYSTEM.INI, and CONFIG.SYS — were commonly abused by nefarious actors.WIN.INIAs you can imagine, this functionality — along with similar files like WIN.INI, SYSTEM.INI, and CONFIG.SYS — were commonly abused by nefarious actors.

Related Articles