Registry Modification to Conceal File Extensions

Threat actors frequently modify specific Windows registry keys to alter File Explorer behavior, specifically to hide known file extensions and system-hidden files. This technique, often associated with malware families such as TrojanSpy:MSIL/Hakey.A, enables attackers to rename malicious executables (e.g., 'document.pdf.exe') so that the '.exe' extension is invisible to the user. By doing so, the actor increases the likelihood that a victim will inadvertently execute a malicious file while believing it to be a harmless document or benign media file. This activity is persistent in nature and is frequently performed during the initial stages of a compromise or by modular malware payloads to maintain a stealthy presence on the host. Defenders should monitor registry modifications targeting the Explorer Advanced configuration keys for unauthorized changes.

Attack Chain

1. Initial access is established via a delivery vector such as spearphishing or a drive-by download.
2. The malicious installer or dropper executes in the user context.
3. The malware identifies the target registry path 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'.
4. The process modifies the 'HideFileExt' registry value to '1' to suppress extension visibility.
5. The process modifies the 'Hidden' registry value to '2' to hide system and hidden files.
6. The adversary drops a payload with a double extension (e.g., 'invoice.pdf.exe').
7. The user interacts with the masqueraded file, believing it to be a legitimate document.
8. Final execution occurs, leading to full system compromise or secondary payload deployment.

Impact

This technique contributes to successful social engineering, increasing the success rate of malware distribution. It has been observed in various ransomware and infostealer campaigns, allowing attackers to maintain persistence and evade detection by unsuspecting users.

Recommendation

Prioritize monitoring for unauthorized changes to registry keys governing Windows Explorer visual settings.

• Deploy the provided Sigma rule to detect registry modifications targeting 'HideFileExt' and 'Hidden' keys.
• Audit logs for registry set operations originating from processes in non-standard locations, such as 'C:\Users\Public' or 'AppData\Local\Temp'.
• Baseline administrative deployment scripts to identify and allowlist legitimate registry modifications, reducing false positives in the SIEM.