Learning Malware Analysis

2.3 Startup Folder

Adversaries can achieve persistence by adding their malicious binary in the startup folders. When the operating system starts, the startup folder is looked up and files residing in this folder are executed. The Windows operating system maintains two types of startup folders: (a) user wide and (b) system-wide, as shown in the following code. A program residing in the user's startup folder is executed only for a specific user and the program residing in the system folder is executed when any user logs on to the system. Administrator privilege is required to achieve persistence using a system-wide startup folder:

C:\%AppData%\Microsoft\Windows\Start Menu\Programs\StartupC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup ...