Procedure examples

StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.

PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Nebulae can achieve persistence through a Registry Run key.

TONESHELL has added Registry Run keys to achieve persistence.

Kasidet creates a Registry Run key to establish persistence.

AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

NETWIRE creates a Registry start-up entry to establish persistence.

EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

Aria-body has established persistence via the Startup folder or Run Registry key.

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

SNUGRIDE establishes persistence through a Registry Run key.

Crimson can add Registry run keys for persistence.

Turian can establish persistence by adding Registry Run keys.

Machete used the startup folder for persistence.

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.

PUBLOAD has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Gootloader can create an autorun entry for a PowerShell script to run at reboot.

AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.

FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.

FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.

Snip3 can create a VBS file in startup to persist after system restarts.

Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.

GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.

InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

CLAIMLOADER has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.

Raspberry Robin will use a Registry key to achieve persistence through reboot, setting a RunOnce key such as: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
{random value name} = “rundll32 shell32 ShellExec_RunDLLA REGSVR /u /s “{dropped copy path and file name}””
.

Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

RustyWater has established persistence by adding `C:\ProgramData\CertificationKit.ini` to a Windows startup Registry key or to a Run or RunOnce Registry key.

IcedID has established persistence by creating a Registry run key.

MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.

PowerShower sets up persistence with a Registry run key.

Kazuar adds a sub-key under several Registry run keys.

NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.

DarkComet adds several Registry entries to enable automatic execution at every system startup.

The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.

Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.

ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.

Avaddon uses registry run keys for persistence.

Conficker adds Registry Run keys to establish persistence.

Flagpro has dropped an executable file to the startup directory.

Hi-Zor creates a Registry Run key to establish persistence.

PUNCHBUGGY has been observed using a Registry Run key.

Pteranodon copies itself to the Startup folder to establish persistence.

DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Run` registry key and by creating a .lnk shortcut file in the Windows startup folder.

CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.