我的測試代碼:
直接使用命令行操作,添加注冊表:
REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v xxxxKey /t REG_SZ /d "powershell -file helloword.ps1"
使用ps添加開機啟動:
$name = "test_date" $value = "powershell -file D:\out_test\test2.ps1" New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $name -PropertyType String -Value $value -ErrorAction Stop
運行方法:
powershell -file add2startup.ps1
再看我的test2.ps1
Write-Host 'Hello, World!' Get-Process | Out-File -FilePath D:\out_test\processes.txt Get-Date | Out-File -FilePath D:\out_test\date.txtt
然后每次開機啟動都會生成2個日期和進程的文件!!!
類似的惡意文件案例:
https://any.run/report/765b38e1840a1d06361268647372dfc164062ceb5b081dfd9ac1f623a5fa2dfa/aaa62403-7ecb-4327-bf47-7edc78d7d4e5#registry
實現開機啟動連接C2服務器:
3660
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
SoftwareUpdater
C:\Users\admin\AppData\Roaming\CTkld85U\presentationhost.exe
https://any.run/report/f5a763e43cf2258a3add2a1769f9cc9aed3da84f108f4f87831bed16dd6a409b/6bbd7ddf-bd22-4684-b343-3e306214b87a
直接通過powershell進程設置:
- Powershell Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value 'C:\Users\admin\AppData\Local\Microsoft\s.vbs
3888
Powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
C:\Users\admin\AppData\Local\Microsoft\s.vbs
類似的,通過mshta創建開機啟動項的:
https://any.run/report/a0c31e0b30559e9ec0bb20242226e569e3979a6b536cb0c96fb2450593890e05/c6d527f7-a532-4aa7-a591-c20b1aa68fc9
------------------------------
PowerShell添加或修改注冊表開機啟動項腳本
2016-12-08 1651
簡介: 代碼如下: $name = Read-Host "請輸入開機啟動項的名字(隨便起)" $value = Read-Host "請輸入開機啟動項的值" try{
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $name -PropertyType String -Value $value -ErrorAction Stop $tip = "成功添加開機啟動項"+$name+"。