Procedure examples

Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.

ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.

Avaddon uses registry run keys for persistence.

Conficker adds Registry Run keys to establish persistence.

Flagpro has dropped an executable file to the startup directory.

Hi-Zor creates a Registry Run key to establish persistence.

PUNCHBUGGY has been observed using a Registry Run key.

Pteranodon copies itself to the Startup folder to establish persistence.

DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Run` registry key and by creating a .lnk shortcut file in the Windows startup folder.

CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.

RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.

BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.

PlugX adds Run key entries in the Registry to establish persistence. PlugX has established persistence via the registry keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.

Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.

S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.

Lumma Stealer has created registry keys to maintain persistence using `HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.

SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.

DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Truvasys adds a Registry Run key to establish persistence.

Sykipot has been known to establish persistence by adding programs to the Run Registry key.

Xbash can create a Startup item for persistence if it determines it is on a Windows system.

Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.

Clambling can establish persistence by adding a Registry run key.

PureCrypter can set multiple Registry Run keys to establish persistence.

DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.

Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.

Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.

If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Gazer can establish persistence by creating a .lnk file in the Start menu.

Latrodectus can set an AutoRun key to establish persistence.

Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.

Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.

LODEINFO has used Registry run keys to set persistence.

Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.

MuddyViper has the ability to establish persistence by configuring its installation directory as a Windows Startup folder by setting the following Registry values to `%APPDATALOCAL%\Microsoft\Windows\PPBCompatCache\ManagerCache`:  `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup`.

EVILNUM can achieve persistence through the Registry Run key.

SMOKEDHAM has used reg.exe to create a Registry Run key.

TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.

GlassWorm has set registry run keys for persistence in both `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\`.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Embargo has modified the Windows Registry to start a custom service named irnagentd in Safe Mode.

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

MagicRAT can persist using malicious LNK objects in the victim machine Startup folder.

TINYTYPHON installs itself under Registry Run key to establish persistence.

A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.

gh0st RAT has added a Registry Run key to establish persistence.