Procedure examples

RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.

BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.

PlugX adds Run key entries in the Registry to establish persistence. PlugX has established persistence via the registry keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.

Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.

S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.

Lumma Stealer has created registry keys to maintain persistence using `HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.

SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.

DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Truvasys adds a Registry Run key to establish persistence.

Sykipot has been known to establish persistence by adding programs to the Run Registry key.

Xbash can create a Startup item for persistence if it determines it is on a Windows system.

Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.

Clambling can establish persistence by adding a Registry run key.

PureCrypter can set multiple Registry Run keys to establish persistence.

DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.

Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.

Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.

If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Gazer can establish persistence by creating a .lnk file in the Start menu.

Latrodectus can set an AutoRun key to establish persistence.

Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.

Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.

LODEINFO has used Registry run keys to set persistence.

Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.

MuddyViper has the ability to establish persistence by configuring its installation directory as a Windows Startup folder by setting the following Registry values to `%APPDATALOCAL%\Microsoft\Windows\PPBCompatCache\ManagerCache`:  `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup`.

EVILNUM can achieve persistence through the Registry Run key.

SMOKEDHAM has used reg.exe to create a Registry Run key.

TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.

GlassWorm has set registry run keys for persistence in both `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\`.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Embargo has modified the Windows Registry to start a custom service named irnagentd in Safe Mode.

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

MagicRAT can persist using malicious LNK objects in the victim machine Startup folder.

TINYTYPHON installs itself under Registry Run key to establish persistence.

A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.

gh0st RAT has added a Registry Run key to establish persistence.

DnsSystem can write itself to the Startup folder to gain persistence.

MoleNet can achieve persitence on the infected machine by setting the Registry run key.

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8} to maintain persistence.

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

Grandoreiro can use run keys and create link files in the startup folder for persistence.

LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.