Procedure examples

Rover has functionality to remove Registry Run key persistence as a cleanup procedure.

Clambling can set and delete Registry keys.

LockBit 3.0 can change the Registry values for Group Policy refresh time, to disable SmartScreen, and to disable Windows Defender.

Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.

Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.

Caterpillar WebShell has a command to modify a Registry key.

Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE\{8 random characters}.

Chaes can modify Registry values to stored information and establish persistence.

CharmPower can remove persistence-related artifacts from the Registry.

MuddyViper has the ability to clear the Registry values in the Windows Startup folder that were previously set for persistence.

TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.

EVILNUM can make modifications to the Regsitry for persistence.

SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.

Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.

QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.

Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Embargo has modified and deleted Registry keys to add services, and to disable Security Solutions such as Windows Defender.

PipeMon has modified the Registry to store its encrypted payload.

KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.

gh0st RAT has altered the InstallTime subkey.

Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.

Black Basta has modified the Registry to enable itself to run in safe mode, to change the icons and file extensions for encrypted files, and to add the malware path for persistence.

Catchamas creates three Registry keys to establish persistence by adding a Windows Service.

Attor's dispatcher can modify the Run registry key.

MegaCortex has added entries to the Registry for ransom contact information.

StreamEx has the ability to modify the Registry.

NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.

Mosquito can modify Registry keys under HKCU\Software\Microsoft\[dllname] to store configuration values. Mosquito also modifies Registry keys under HKCR\CLSID\...\InprocServer32 with a path to the launcher.

RTM can delete all Registry entries created during its execution.

BlackByte Ransomware modifies the victim Registry to prevent system recovery.

Grandoreiro can modify the Registry to store its configuration at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.

Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.

SOUNDBITE is capable of modifying the Registry.

BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List.

HiddenFace can store its configuration file in the Registry.

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.

Kapeka writes persistent configuration information to the victim host registry.

LockBit 2.0 can create Registry keys to bypass UAC and for persistence.

Pandora can write an encrypted token to the Registry to enable processing of remote commands.

Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to enable the execution of additional code.

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

REvil can modify the Registry to save encryption parameters and system information.

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.

Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.

PoisonIvy creates a Registry subkey that registers a new system device.

NanoCore has the capability to edit the Registry.