This old series is not very exciting. Decompiling goodware installation scripts will never lead us to newsworthy discoveries – feel free to stop reading now.

Many installers copy files, add/change registry keys and values, install services, drivers, and do all that while their GUIs sometimes tell us what is happening, and occasionally ask us to guide them. Superboring stuff.

If you are still reading…

Recently, I noticed that some of the aforementioned ‘add/change registry keys and values’ activities affect the Process Environment block. The most popular modification is (obviously) focused on the PATH environment variable – installers just love adding new directories to it!

BUT

There is more.

The below is a list (not exhaustive) of other environment variables that are being added by installers:

• ACE_STUDIO_PATH
• BRAINGINES_PATH
• CC_PIXEL_RATIO
• DELIGHT
• FLOW_PATH
• FMXLINUX
• GIT_LFS_PATH
• GPU_AUDIO_PLUGIN_INSTALLATION_PATH
• IDF_TOOLS_PATH
• IFCEXPORTER
• INTELBRAS_AMTRD_JAVA_HOME
• JAVA_HOME
• JETTY_WEB_HOME
• JIOCLOUD_INSTALL_TYPE
• LANDO_INSTALL_PATH
• LANG
• LANG_PSERVER
• P3DEXPORTER
• QT_DEVICE_PIXEL_RATIO
• RTOOLS43_HOME
• RTOOLS44_AARCH64_HOME
• RTOOLS44_HOME
• XR_RUNTIME_JSON

While some of them seem to be quite unimportant, a lot of them seem to be asking for some … abuse (aka research) ?

I mean… anything that includes ‘PATH’ or ‘HOME’ in their name needs an appropriate research-driven follow-up.

Why?

All of them are under HKCU, so anyone can modify them. Secondly, these environment variables may open new ways to abuse legitimate, often signed binaries to do something they never intended to do – and as such, create new lolbin opportunities. It could be loading plug-ins from a malicious location, it could be executing framework binaries from a controlled location, there is definitely a scope for research here.