Procedure examples

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.

Turla has modified Registry values to store payloads.

TA505 has used malware to disable Windows Defender through modification of the Registry.

Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.

Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.

LuminousMoth has used malware that adds Registry keys for persistence.

APT42 has modified Registry keys to maintain persistence.

Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]” for persistence.

Silence can create, delete, or modify a specified Registry key or value.

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.

Magic Hound has modified Registry settings for security tools.

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.

FIN8 has deleted Registry keys during post compromise cleanup activities.

APT19 uses a Port 22 malware variant to modify several Registry keys.

TrickBot can modify registry entries.

RCSession can write its configuration file to the Registry.

SynAck can manipulate Registry keys.

Exaramel for Windows adds the configuration to the Registry in XML format.

Amadey has overwritten registry keys for persistence.

Orz can perform Registry operations.

Stuxnet can create registry keys to load driver files.

KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.

Ursnif has used Registry modifications as part of its installation routine.

ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.

Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.

PLAINTEE uses reg add to add a Registry Run key for persistence.

NETWIRE can modify the Registry to store its configuration information.

TinyTurla can set its configuration parameters in the Registry.

BOOKWORM has modified Registry key values as part of its created service `DeviceSync`.

HyperStack can add the name of its communication pipe to HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes.

GreyEnergy modifies conditions in the Registry and adds keys.

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

TEARDROP modified the Registry to create a Windows service for itself on a compromised host.

Mafalda can manipulate the system registry on a compromised host.

PolyglotDuke can write encrypted JSON configuration files to the Registry.

ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.

BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.

HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.

WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.

RegDuke can create seemingly legitimate Registry key to store its encryption key.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.

Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

TRANSLATEXT has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist`.

Regin appears to have functionality to modify remote Registry information.

Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.

BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`