Procedure examples

BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List.

HiddenFace can store its configuration file in the Registry.

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.

Kapeka writes persistent configuration information to the victim host registry.

LockBit 2.0 can create Registry keys to bypass UAC and for persistence.

Pandora can write an encrypted token to the Registry to enable processing of remote commands.

Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to enable the execution of additional code.

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

REvil can modify the Registry to save encryption parameters and system information.

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.

Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.

PoisonIvy creates a Registry subkey that registers a new system device.

NanoCore has the capability to edit the Registry.

TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers to enable document stealing.

IPsec Helper can make arbitrary changes to registry keys based on provided input.

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’.

Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.

Pillowmint has modified the Registry key HKLM\SOFTWARE\Microsoft\DRM to store a malicious payload.

SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

Nerex creates a Registry subkey that registers a new service.

Clop can make modifications to Registry keys.

Lokibot has modified the Registry as part of its UAC bypass process.

PoetRAT has made registry modifications to alter its behavior upon execution.

CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.

ZxShell can create Registry entries to enable services to run.

njRAT can create, delete, or modify a specified Registry key or value.

HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads.

metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.

KOCTOPUS has added and deleted keys from the Registry.

Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client. Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.

Agent Tesla can achieve persistence by modifying Registry key entries.

ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.

QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Gelsemium can modify the Registry to store its components.

Waterbear has deleted certain values from the Registry to load a malicious DLL.

PHOREAL is capable of manipulating the Registry.

BitPaymer can set values in the Registry to help in execution.

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.

ADVSTORESHELL is capable of setting and deleting Registry values.

WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.

SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.

NPPSPY modifies the Registry to record the malicious listener for output from the Winlogon process.

SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).

AADInternals can modify registry keys as part of setting a new pass-through authentication agent.

PcShare can delete its persistence mechanisms from the registry.

CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.