10/7/2023 0 Comments Where to put .scr files![]() ScreenSaverIsSecure - set to '0' to not require a password to unlock.ScreenSaveActive - set to '1' to enable the screensaver.SCRNSAVE.exe - set to malicious PE path. The following screensaver settings are stored in the Registry ( HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence: The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a. Adversaries may establish persistence by executing malicious content triggered by user inactivity.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |