Procedure examples

ROADSWEEP has been placed in the start up folder to trigger execution upon user login.

SysUpdate can use a Registry Run key to establish persistence.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Some InnaputRAT variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.

GrimAgent can set persistence with a Registry run key.

LookBack sets up a Registry Run key to establish a persistence mechanism.

PoetRAT has added a registry key in the <RUN> hive for persistence.

FELIXROOT adds a shortcut file to the startup folder for persistence.

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

build_downer has the ability to add itself to the Registry Run key for persistence.

Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.

HIUPAN has added Registry Run keys to achieve persistence using `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

TURNEDUP is capable of writing to a Registry Run key to establish.

ChChes establishes persistence by adding a Registry Run key.

ANDROMEDA can establish persistence by dropping a sample of itself to `C:\ProgramData\Local Settings\Temp\mskmde.com` and adding a Registry run key to execute every time a user logs on.

KOCTOPUS can set the AutoRun Registry key with a PowerShell command.

Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.

Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.

STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.

DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.

One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Agent Tesla can add itself to the Registry as a startup program to establish persistence.

POWERTON can install a Registry Run key for persistence.

BADNEWS installs a registry Run key to establish persistence.

Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.

Astaroth creates a startup item for persistence.

QakBot can maintain persistence by creating an auto-run Registry key.

Hancitor has added Registry Run keys to establish persistence.

Gelsemium can set persistence with a Registry run key.

Helminth establishes persistence by creating a shortcut in the Start Menu folder.

Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.

Vasport copies itself to disk and creates an associated run key Registry entry to establish.

BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.

WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.

Small Sieve has the ability to add itself to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift` for persistence.

SILENTTRINITY can establish a LNK file in the startup folder for persistence.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

MCMD can use Registry Run Keys for persistence.

Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.

Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.