Procedure examples

TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers to enable document stealing.

IPsec Helper can make arbitrary changes to registry keys based on provided input.

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’.

Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.

Pillowmint has modified the Registry key HKLM\SOFTWARE\Microsoft\DRM to store a malicious payload.

SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

Nerex creates a Registry subkey that registers a new service.

Clop can make modifications to Registry keys.

Lokibot has modified the Registry as part of its UAC bypass process.

PoetRAT has made registry modifications to alter its behavior upon execution.

CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.

ZxShell can create Registry entries to enable services to run.

njRAT can create, delete, or modify a specified Registry key or value.

HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads.

metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.

KOCTOPUS has added and deleted keys from the Registry.

Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client. Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.

Agent Tesla can achieve persistence by modifying Registry key entries.

ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.

QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Gelsemium can modify the Registry to store its components.

Waterbear has deleted certain values from the Registry to load a malicious DLL.

PHOREAL is capable of manipulating the Registry.

BitPaymer can set values in the Registry to help in execution.

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.

ADVSTORESHELL is capable of setting and deleting Registry values.

WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.

SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.

NPPSPY modifies the Registry to record the malicious listener for output from the Winlogon process.

SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).

AADInternals can modify registry keys as part of setting a new pass-through authentication agent.

PcShare can delete its persistence mechanisms from the registry.

CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.

Remcos has full control of the Registry, including the ability to modify it.

CrackMapExec can create a registry key using wdigest.

Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.

QuasarRAT has a command to edit the Registry on the victim’s machine.