Procedure examples

EVILNUM can achieve persistence through the Registry Run key.

SMOKEDHAM has used reg.exe to create a Registry Run key.

TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.

GlassWorm has set registry run keys for persistence in both `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\`.

Metamorfo has configured persistence to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Embargo has modified the Windows Registry to start a custom service named irnagentd in Safe Mode.

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

MagicRAT can persist using malicious LNK objects in the victim machine Startup folder.

TINYTYPHON installs itself under Registry Run key to establish persistence.

A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.

gh0st RAT has added a Registry Run key to establish persistence.

DnsSystem can write itself to the Startup folder to gain persistence.

MoleNet can achieve persitence on the infected machine by setting the Registry run key.

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8} to maintain persistence.

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

Grandoreiro can use run keys and create link files in the startup folder for persistence.

LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.

Bazar can create or add files to Registry Run Keys to establish persistence.

BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.

Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Final1stspy creates a Registry Run key to establish persistence.

LockBit 2.0 can use a Registry Run key to establish persistence at startup.

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.

CrossRAT uses run keys for persistence on Windows.

EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.

Cobian RAT creates an autostart Registry key to ensure persistence.

ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.

JCry has created payloads in the Startup directory to maintain persistence.

USBStealer registers itself under a Registry Run key with the name "USB Disk Security."

Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.

Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.

NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup.

Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.

Pisloader establishes persistence via a Registry Run key.

Gold Dragon establishes persistence in the Startup folder.

Ramsay has created Registry Run keys to establish persistence.

Carberp has maintained persistence by placing itself inside the current user's startup folder.

FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.