Procedure examples

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

RedCurl has established persistence by creating entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

APT29 added Registry Run keys to establish persistence.

Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.

Darkhotel has been known to establish persistence by adding programs to the Run Registry key.

LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.

Windshift has created LNK files in the Startup folder to establish persistence.

LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.

APT28 has deployed malware that has copied itself to the startup directory for persistence.

RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.

Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.

Moonstone Sleet used registry run keys for process execution during initial victim infection.

Inception has maintained persistence by modifying Registry run key value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.

PROMETHIUM has used Registry run keys to establish persistence.

Magic Hound malware has used Registry Run keys to establish persistence.

Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.

APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.

FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.

FIN13 has used Windows Registry run keys such as, `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts` to maintain persistence.

An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.

TrickBot establishes persistence in the Startup folder.

PowerDuke achieves persistence by using various Registry Run keys.

Pikabot maintains persistence following system checks through the Run key in the registry.

RCSession has the ability to modify a Registry Run key to establish persistence.

GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.

NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Backdoor.Oldrea adds Registry Run keys to achieve persistence.

AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.

Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.

SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.

Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.

Variants of Emissary have added Run Registry keys to establish persistence.

HeartCrypt can set the `CurrentVersion\Run` key to establish persistence.

Ursnif has used Registry Run keys to establish automatic execution at system startup.

ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.

RansomHub has created an autorun Registry key through the `-safeboot-instance -pass` command line argument.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.

POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.

Tsundere Botnet has created a value in the `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` Registry key, ensuring that it is run at login.

Zeus Panda adds persistence by creating Registry Run keys.

Matryoshka can establish persistence by adding Registry Run keys.

InvisibleFerret has established persistence within Windows devices by creating a .bat file “queue.bat” within the Startup folder to run a Python script.