MissionEvasion: The New Windows Tool That Evades Detection
MissionEvasion is a sophisticated Windows process injection tool that implements multiple evasion techniques, including registry-based file hiding, process hollowing, and process overwriting. The tool supports both x64 and x86 architectures and provides a flexible interface through CLI, interactive mode, and configuration files.
Features
- Multiple Injection Techniques
- Process Hollowing
- Process Overwriting (Windows 11 24H2 compatible)
- Flexible Input Methods
- File-based payload loading
- Registry-based payload storage and loading
- Architecture Support
- x64 (64-bit) support
- x86 (32-bit) support
- User Interface Options
- Command-line interface
- Interactive mode
- Configuration file support
- Custom Payload Support
- Built-in test payloads for both x64 and x86
- Support for custom payloads
Technical Details
Process Overwriting
Process Overwriting was implemented to bypass the new restrictions introduced in Windows 11 24H2. Unlike Process Hollowing, this technique injects and resumes the process from a MEM_IMAGE region as opposed to MEM_PRIVATE.
Implementation Steps:
- A benign process is started in a suspended state
- Using VirtualProtectEx, the memory regions are configured with appropriate permissions
- The memory region is overwritten with the payload
- Section permissions are patched to match PE requirements
- The process is resumed, executing the payload seamlessly
Advantages:
- Bypasses MEM_PRIVATE restrictions
- Avoids triggering ZwQueryVirtualMemory checks for MEM_IMAGE
- Enhanced stealth through existing memory region utilization
Registry-based File Hiding
The tool can store PE files in the Windows Registry, split into multiple parts for better management and stealth.
Important Notes
- Architecture matching is required:
- 32-bit loader for 32-bit to 32-bit injection
- 64-bit loader for 64-bit to 64-bit injection
- Process type matching is required:
- GUI to GUI
- Console to Console
- Sizing requirements
- Source image size must be smaller than Destination image size
Download & Use
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
