Procedure examples

Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.

Bad Rabbit’s infpub.dat file uses NTLM login credentials to brute force Windows machines.

MailSniper can be used for password spraying against Exchange and Office 365.

CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.

TrickBot uses brute-force attack against RDP with rdpscanDll module.

Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.

SLOWPULSE can log credentials on compromised Pulse Secure VPNs during the `DSAuth::AceAuthServer::checkUsernamePassword`ACE-2FA authentication procedure.

evilginx2 can intercept authentication tokens to enable bypass of non-phishing resistant forms of MFA.

TrickBot can modify registry entries.

RCSession can write its configuration file to the Registry.

SynAck can manipulate Registry keys.

Exaramel for Windows adds the configuration to the Registry in XML format.

Amadey has overwritten registry keys for persistence.

Orz can perform Registry operations.

Stuxnet can create registry keys to load driver files.

KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.

Ursnif has used Registry modifications as part of its installation routine.

ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.

Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.

PLAINTEE uses reg add to add a Registry Run key for persistence.

NETWIRE can modify the Registry to store its configuration information.

TinyTurla can set its configuration parameters in the Registry.

BOOKWORM has modified Registry key values as part of its created service `DeviceSync`.

HyperStack can add the name of its communication pipe to HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes.

GreyEnergy modifies conditions in the Registry and adds keys.

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

TEARDROP modified the Registry to create a Windows service for itself on a compromised host.

Mafalda can manipulate the system registry on a compromised host.

PolyglotDuke can write encrypted JSON configuration files to the Registry.

ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.

BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.

HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.

WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.

RegDuke can create seemingly legitimate Registry key to store its encryption key.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.

Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

TRANSLATEXT has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist`.

Regin appears to have functionality to modify remote Registry information.

Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.

BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`

PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.

DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0” and HKEY_CURRENT_USER\Software\DC3_FEXEC.

CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.

zwShell can modify the Registry.

DCSrv has created Registry keys for persistence.

ShimRat has registered two registry keys for shim databases.

Avaddon modifies several registry keys for persistence and UAC bypass.