Image File Execution Options (IFEO) allows one to launch an executable directly under the debugger. It gives the developer the option to debug their software to investigate issues in the executable's startup code. A developer can create a subkey with the name of his/her executable under the following registry key and set the debugger value to the path of the debugger:
Key: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable name>"Value: Debugger : REG_SZ : <full-path to the debugger>
Adversaries take advantage of this registry key to launch their malicious program. To demonstrate this technique, the debugger for notepad.exe is set to a calculator (calc.exe) process by ...
