Procedure examples

FinFisher queries Registry values as part of its anti-sandbox checks.

Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

REvil can query the Registry to get random file extensions to append to encrypted files.

Valak can use the Registry for code updates and to collect credentials.

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.

Carbon enumerates values in the Registry.

Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.

ZxShell can query the netsvc group value data located in the svchost group Registry key.

BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.

njRAT can read specific registry values.

ComRAT can check the default browser by querying HKCR\http\shell\open\command.

JPIN can enumerate Registry keys.

Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

DownPaper searches and reads the value of the Windows Update Registry Run key.

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Denis queries the Registry for keys and values.

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.

OSInfo queries the registry to look for information about Terminal Services.

Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.

Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

ADVSTORESHELL can enumerate registry keys.

SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.

PcShare can search the registry files of a compromised host.

Remcos can obtain Registry data from targeted systems.

Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.

ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.

APT41 deployed rootkits on Linux systems.

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.

Winnti Group used a rootkit to modify typical server functionality.

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.

MEDUSA is a rootkit with command execution and credential logging capabilities.

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.