Procedure examples

Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.

Variants of Emissary have added Run Registry keys to establish persistence.

HeartCrypt can set the `CurrentVersion\Run` key to establish persistence.

Ursnif has used Registry Run keys to establish automatic execution at system startup.

ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.

RansomHub has created an autorun Registry key through the `-safeboot-instance -pass` command line argument.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.

Tsundere Botnet has created a value in the `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` Registry key, ensuring that it is run at login.

Zeus Panda adds persistence by creating Registry Run keys.

Matryoshka can establish persistence by adding Registry Run keys.

InvisibleFerret has established persistence within Windows devices by creating a .bat file “queue.bat” within the Startup folder to run a Python script.

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.

PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Nebulae can achieve persistence through a Registry Run key.

TONESHELL has added Registry Run keys to achieve persistence.

Kasidet creates a Registry Run key to establish persistence.

AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

NETWIRE creates a Registry start-up entry to establish persistence.

EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

Aria-body has established persistence via the Startup folder or Run Registry key.

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

SNUGRIDE establishes persistence through a Registry Run key.

Crimson can add Registry run keys for persistence.

Turian can establish persistence by adding Registry Run keys.

Machete used the startup folder for persistence.

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.

PUBLOAD has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Gootloader can create an autorun entry for a PowerShell script to run at reboot.

AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.

FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.

FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.

Snip3 can create a VBS file in startup to persist after system restarts.

Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.

GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.

InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

CLAIMLOADER has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.

Raspberry Robin will use a Registry key to achieve persistence through reboot, setting a RunOnce key such as: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
{random value name} = “rundll32 shell32 ShellExec_RunDLLA REGSVR /u /s “{dropped copy path and file name}””
.

Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

RustyWater has established persistence by adding `C:\ProgramData\CertificationKit.ini` to a Windows startup Registry key or to a Run or RunOnce Registry key.

IcedID has established persistence by creating a Registry run key.

MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.

PowerShower sets up persistence with a Registry run key.

Kazuar adds a sub-key under several Registry run keys.

NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.

DarkComet adds several Registry entries to enable automatic execution at every system startup.

The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.