Procedure examples

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.

Bazar can create or add files to Registry Run Keys to establish persistence.

BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.

Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Final1stspy creates a Registry Run key to establish persistence.

LockBit 2.0 can use a Registry Run key to establish persistence at startup.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.

CrossRAT uses run keys for persistence on Windows.

EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.

Cobian RAT creates an autostart Registry key to ensure persistence.

ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.

JCry has created payloads in the Startup directory to maintain persistence.

USBStealer registers itself under a Registry Run key with the name "USB Disk Security."

Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.

Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.

NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup.

Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.

Pisloader establishes persistence via a Registry Run key.

Gold Dragon establishes persistence in the Startup folder.

Ramsay has created Registry Run keys to establish persistence.

Carberp has maintained persistence by placing itself inside the current user's startup folder.

FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.

ROADSWEEP has been placed in the start up folder to trigger execution upon user login.

SysUpdate can use a Registry Run key to establish persistence.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Some InnaputRAT variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.

GrimAgent can set persistence with a Registry run key.

LookBack sets up a Registry Run key to establish a persistence mechanism.

PoetRAT has added a registry key in the <RUN> hive for persistence.

FELIXROOT adds a shortcut file to the startup folder for persistence.

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

build_downer has the ability to add itself to the Registry Run key for persistence.

Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.

HIUPAN has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

TURNEDUP is capable of writing to a Registry Run key to establish.

ChChes establishes persistence by adding a Registry Run key.

ANDROMEDA can establish persistence by dropping a sample of itself to `C:\ProgramData\Local Settings\Temp\mskmde.com` and adding a Registry run key to execute every time a user logs on.

KOCTOPUS can set the AutoRun Registry key with a PowerShell command.

Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.

Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.