Learning Malware Analysis

2.6 Accessibility Programs

The Windows operating system provides various accessibility features such as the On-screen keyboard, Narrator, Magnifier, Speech recognition, and so on. These features are mainly designed for people with special needs. These accessibility programs can be launched without even logging into the system. For example, many of these accessibility programs can be accessed by pressing the Windows + U key combination, which launches C:\Windows\System32\utilman.exe, or you can enable sticky keys by pressing the shift key five times, which will launch the program C:\Windows\System32\sethc.exe. An attacker can change the way these accessibility programs (such as sethc.exe and utilman.exe) are launched to execute a program of ...