I managed to compile HijackThis+

[HydraDragonAntivirus]

My next goal interagate: https://github.com/HydraDragonAntivirus/OpenSourceViruses/blob/main/suspiciousregchangesandtaskkils

[dragokas]

Hi,
most of presented keys are already exists in HiJackThis+.

E.g. all "Image File Execution Options" are present in O26 (https://dragokas.com/tools/help/hjt_tutorial.html#O26)

Before making such a proposal, we require:

1. Default data for each value to be able to use "fix" functionalty. If value may have several default values, we need to know the meaning of them.
2. Careful study of each key to know the purpose. It is required to split keys among specific sections of HJT log. I'm only talking about some rare and strange keys in your list like telemetry and cursor, because I've no idea what are they for (from a threat detection point of view).

In its current form I can only add some Policy keys.
Thank you.

[HydraDragonAntivirus]

Okay then I should find new idea. I see some malwares are abusing Windows Setup registry but that's not so common sense. set \"key=HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\"\r\nset \"value=CmdLine\"\r\nreg add \"%key%\" /v \"%value%\" /t REG_SZ /d \"\" /f\r\nendlocal\r\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\" /v OOBEInProgress /t REG_DWORD /d 0 /f\r\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\" /v SetupType /t REG_DWORD /d 0 /f\r\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\" /v SetupPhase /t REG_DWORD /d 0 /f\r\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\" /v SystemSetupInProgress /t REG_DWORD /d 0 /f\r\nshutdown /r"); Like this code did. But I need look code for a while. Otherwise, I just going to make project more unstable due to my mistakes.

[HydraDragonAntivirus]

Okay I finally find my goal. I want to detect this change. My method didn't give any errors and I didn't shared with you yet but it's not tested. Here is the going to detected change by program:` Private Sub LockRegistryKey(keyPath As String)
Try
' Open the registry key with permission to change security
Using key As RegistryKey = Registry.LocalMachine.OpenSubKey(keyPath, RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.ChangePermissions)
If key IsNot Nothing Then
' Get the current security settings
Dim security As RegistrySecurity = key.GetAccessControl()

                ' Remove all access to the key
                Dim everyone As New SecurityIdentifier(WellKnownSidType.WorldSid, Nothing)
                Dim system As New SecurityIdentifier(WellKnownSidType.LocalSystemSid, Nothing)
                Dim admins As New SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, Nothing)

                ' Purge existing access rules
                security.PurgeAccessRules(everyone)
                security.PurgeAccessRules(system)
                security.PurgeAccessRules(admins)

                ' Remove all access rights for everyone, system, and admins
                security.AddAccessRule(New RegistryAccessRule(everyone, RegistryRights.FullControl, AccessControlType.Deny))
                security.AddAccessRule(New RegistryAccessRule(system, RegistryRights.FullControl, AccessControlType.Deny))
                security.AddAccessRule(New RegistryAccessRule(admins, RegistryRights.FullControl, AccessControlType.Deny))

                ' Apply the changes to the registry key
                key.SetAccessControl(security)
            End If
        End Using

    Catch ex As Exception
        MessageBox.Show("An error occurred while lock: " & ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
    End Try
End Sub`

[dragokas]

Thank for notifying about Setup key. I'll take a closer look.

[dragokas]

By the way, the correct compilation procedure is - to run the "makefile.cmd" or "_2_Make_UPX_Sign.cmd" script.
The direct compilation is not production ready. It may miss some features.

[HydraDragonAntivirus]

Sorry I forgot to show this line too:

  RegistryKey subKey = Registry.LocalMachine.CreateSubKey("SYSTEM\\Setup");
          subKey.SetValue("CmdLine", (object) "C:\\temp.bat", RegistryValueKind.String);
          subKey.Close();
        }

[dragokas]

Yeah, this is the main. I'll add in the next update.

[HydraDragonAntivirus]

Should we check X: drive EFI partition to any possible BlackLotus like malwares? Anormal file size etc.

[dragokas]

I have that in my internal TODO list as well as indicators of compromise.