Procedure examples

TrickBot establishes persistence in the Startup folder.

PowerDuke achieves persistence by using various Registry Run keys.

Pikabot maintains persistence following system checks through the Run key in the registry.

RCSession has the ability to modify a Registry Run key to establish persistence.

GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.

NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Backdoor.Oldrea adds Registry Run keys to achieve persistence.

AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.

Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.

SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.

Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.

Variants of Emissary have added Run Registry keys to establish persistence.

HeartCrypt can set the `CurrentVersion\Run` key to establish persistence.

Ursnif has used Registry Run keys to establish automatic execution at system startup.

ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.

RansomHub has created an autorun Registry key through the `-safeboot-instance -pass` command line argument.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.

Tsundere Botnet has created a value in the `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` Registry key, ensuring that it is run at login.

Zeus Panda adds persistence by creating Registry Run keys.

Matryoshka can establish persistence by adding Registry Run keys.

InvisibleFerret has established persistence within Windows devices by creating a .bat file “queue.bat” within the Startup folder to run a Python script.

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.

PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Nebulae can achieve persistence through a Registry Run key.

TONESHELL has added Registry Run keys to achieve persistence.

Kasidet creates a Registry Run key to establish persistence.

AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

NETWIRE creates a Registry start-up entry to establish persistence.

EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

Aria-body has established persistence via the Startup folder or Run Registry key.

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

SNUGRIDE establishes persistence through a Registry Run key.

Crimson can add Registry run keys for persistence.

Turian can establish persistence by adding Registry Run keys.

Machete used the startup folder for persistence.

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.

PUBLOAD has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Gootloader can create an autorun entry for a PowerShell script to run at reboot.

AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.

FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.

FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.

Snip3 can create a VBS file in startup to persist after system restarts.

Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.

GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.

InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

CLAIMLOADER has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.