Procedure examples

TrickBot can modify registry entries.

RCSession can write its configuration file to the Registry.

SynAck can manipulate Registry keys.

Exaramel for Windows adds the configuration to the Registry in XML format.

Amadey has overwritten registry keys for persistence.

Orz can perform Registry operations.

Stuxnet can create registry keys to load driver files.

KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.

Ursnif has used Registry modifications as part of its installation routine.

ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.

Prestige has the ability to register new registry keys for a new extension handler via `HKCR\.enc` and `HKCR\enc\shell\open\command`.

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.

PLAINTEE uses reg add to add a Registry Run key for persistence.

NETWIRE can modify the Registry to store its configuration information.

TinyTurla can set its configuration parameters in the Registry.

BOOKWORM has modified Registry key values as part of its created service `DeviceSync`.

HyperStack can add the name of its communication pipe to HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes.

GreyEnergy modifies conditions in the Registry and adds keys.

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

TEARDROP modified the Registry to create a Windows service for itself on a compromised host.

Mafalda can manipulate the system registry on a compromised host.

PolyglotDuke can write encrypted JSON configuration files to the Registry.

ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.

BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.

HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.

WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.

RegDuke can create seemingly legitimate Registry key to store its encryption key.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.

Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

TRANSLATEXT has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist`.

Regin appears to have functionality to modify remote Registry information.

Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.

BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`

PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.

DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0” and HKEY_CURRENT_USER\Software\DC3_FEXEC.

CHIMNEYSWEEP can use the Windows Registry Environment key to change the `%windir%` variable to point to `c:\Windows` to enable payload execution.

zwShell can modify the Registry.

DCSrv has created Registry keys for persistence.

ShimRat has registered two registry keys for shim databases.

Avaddon modifies several registry keys for persistence and UAC bypass.

Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.

DarkTortilla has modified registry keys for persistence.

ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.

DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.

PlugX has a module to create, delete, or modify Registry keys.

Bisonal has deleted Registry keys to clean up its prior activity.

NOOPLDR can store its payload in the Registry using a random hex string in `HKCU\SOFTWARE\Microsoft\COM3`.

Explosive has a function to write itself to Registry values.