in cortado/rtas/registry_persistence_create.py [0:0]
def _winreg_calls():
winreg = _common.get_winreg()
# create Services subkey for "ServiceTest"
log.info("Creating ServiceTest registry key")
hklm = winreg.HKEY_LOCAL_MACHINE
hkey = winreg.CreateKey(hklm, "System\\CurrentControlSet\\Services\\ServiceTest\\")
# create "ServiceTest" data values
log.info("Updating ServiceTest metadata")
winreg.SetValueEx(hkey, "Description", 0, winreg.REG_SZ, "A fake service")
winreg.SetValueEx(hkey, "DisplayName", 0, winreg.REG_SZ, "ServiceTest Service")
winreg.SetValueEx(hkey, "ImagePath", 0, winreg.REG_SZ, "c:\\ServiceTest.exe")
winreg.SetValueEx(hkey, "ServiceDLL", 0, winreg.REG_SZ, "C:\\ServiceTest.dll")
# modify contents of ServiceDLL and ImagePath
log.info("Modifying ServiceTest binary")
winreg.SetValueEx(hkey, "ImagePath", 0, winreg.REG_SZ, "c:\\ServiceTestMod.exe")
winreg.SetValueEx(hkey, "ServiceDLL", 0, winreg.REG_SZ, "c:\\ServiceTestMod.dll")
hkey.Close()
pause()
# delete Service subkey for "ServiceTest"
log.info("Removing ServiceTest")
hkey = winreg.CreateKey(hklm, "System\\CurrentControlSet\\Services\\")
winreg.DeleteKeyEx(hkey, "ServiceTest")
hkey.Close()
pause()