Procedure examples

DnsSystem can write itself to the Startup folder to gain persistence.

MoleNet can achieve persitence on the infected machine by setting the Registry run key.

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8} to maintain persistence.

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

Grandoreiro can use run keys and create link files in the startup folder for persistence.

LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.

Bazar can create or add files to Registry Run Keys to establish persistence.

BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.

Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Final1stspy creates a Registry Run key to establish persistence.

LockBit 2.0 can use a Registry Run key to establish persistence at startup.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.

CrossRAT uses run keys for persistence on Windows.

EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.

Cobian RAT creates an autostart Registry key to ensure persistence.

ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.

JCry has created payloads in the Startup directory to maintain persistence.

USBStealer registers itself under a Registry Run key with the name "USB Disk Security."

Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.

Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.

NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup.

Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.

Pisloader establishes persistence via a Registry Run key.

Gold Dragon establishes persistence in the Startup folder.

Ramsay has created Registry Run keys to establish persistence.

Carberp has maintained persistence by placing itself inside the current user's startup folder.

FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.

ROADSWEEP has been placed in the start up folder to trigger execution upon user login.

SysUpdate can use a Registry Run key to establish persistence.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Some InnaputRAT variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.

GrimAgent can set persistence with a Registry run key.

LookBack sets up a Registry Run key to establish a persistence mechanism.

PoetRAT has added a registry key in the <RUN> hive for persistence.

FELIXROOT adds a shortcut file to the startup folder for persistence.

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

build_downer has the ability to add itself to the Registry Run key for persistence.