Modify Registry

AADInternals can modify registry keys as part of setting a new pass-through authentication agent.^[6]

ADVSTORESHELL is capable of setting and deleting Registry values.^[7]

Agent Tesla can achieve persistence by modifying Registry key entries.^[8]

APT19 uses a Port 22 malware variant to modify several Registry keys.^[9]

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration. ^[10]

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.^[11]

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.^[12][13]

Attor's dispatcher can modify the Run registry key.^[14]

Avaddon modifies several registry keys for persistence and UAC bypass.^[15]

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.^[16]

BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\List.^[17]

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.^[18]

Bisonal has deleted Registry keys to clean up its prior activity.^[19]

BitPaymer can set values in the Registry to help in execution.^[20]

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.^[21]

Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.^[22]

Catchamas creates three Registry keys to establish persistence by adding a Windows Service.^[23]

Caterpillar WebShell has a command to modify a Registry key.^[24]

Chaes stored its instructions in a config file in the Registry.^[25]

CharmPower can remove persistence-related artifacts from the Registry.^[26]

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.^[27]

Clambling can set and delete Registry keys.^[28]

Clop can make modifications to Registry keys.^[29]

Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to enable the execution of additional code.^[30]

ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key.^[31][32]

Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.^[33][34]

CrackMapExec can create a registry key using wdigest.^[35]

Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.^[36]

CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.^[37]

DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA="0" and HKEY_CURRENT_USER\Software\DC3_FEXEC.^[38][39]

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.^[40]

Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.^[41]

EVILNUM can make modifications to the Regsitry for persistence.^[42]

Exaramel for Windows adds the configuration to the Registry in XML format.^[43]

Explosive has a function to write itself to Registry values.^[44]

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.^[45]

Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.^[46]

FIN8 has deleted Registry keys during post compromise cleanup activities.^[47]

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.^[48][49]

Gelsemium has the ability to store its components in the Registry.^[50]

gh0st RAT has altered the InstallTime subkey.^[51]

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.^[52]

Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.^[53]

GreyEnergy modifies conditions in the Registry and adds keys.^[54]

HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.^[55][56][57]

Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.^[58]

HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.^[59]

Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.^[60][61]

HyperStack can add the name of its communication pipe to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes.^[62]

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.^[63][64]

KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.^[65]

Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.^{[66][67][68][69]}

KOCTOPUS has added and deleted keys from the Registry.^[70]

KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.^[71][72]

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’.^[73]

Lokibot has modified the Registry as part of its UAC bypass process.^[74]

MegaCortex has added entries to the Registry for ransom contact information.^[75]

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.^{[76][77][78][79]}

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname] and modifies Registry keys under HKCR\CLSID...\InprocServer32with a path to the launcher.^[80]

Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.^[81]

NanoCore has the capability to edit the Registry.^[82][83]

Neoichor has the ability to configure browser settings by modifying Registry entries under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer.^[84]

Nerex creates a Registry subkey that registers a new service.^[85]

Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE{{8 random characters}}.^[86]

NETWIRE stores its configuration file within the Registry.^[87]

njRAT can create, delete, or modify a specified Registry key or value.^[88][89]

Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.^[90]

Orz can perform Registry operations.^[91]

Pandora can write an encrypted token to the Registry to enable processing of remote commands.^[92]

A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.^[93]

PHOREAL is capable of manipulating the Registry.^[94]

Pillowmint has stored its malicious payload in the registry key HKLM\SOFTWARE\Microsoft\DRM.^[95]

PipeMon has stored its encrypted payload in the Registry.^[96]

PLAINTEE uses reg add to add a Registry Run key for persistence.^[97]

PlugX has a module to create, delete, or modify Registry keys.^[98]

PoetRAT has made registry modifications to alter its behavior upon execution.^[99]

PoisonIvy creates a Registry subkey that registers a new system device.^[100]

PolyglotDuke can write encrypted JSON configuration files to the Registry.^[101]

PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.^[102]

Pysa has modified the registry key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and added the ransom note.^[103]

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.^[104][105]

QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.^[106]

QuasarRAT has a command to edit the Registry on the victim’s machine.^[107]

RCSession can write its configuration file to the Registry.^[28][108]

Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.^[1]

RegDuke can store its encryption key in the Registry.^[101]

Regin appears to have functionality to modify remote Registry information.^[109]

Remcos has full control of the Registry, including the ability to modify it.^[110]

REvil can save encryption parameters and system information to the Registry.^{[111][112][113][114][115]}

ROKRAT can modify the HKEY_CURRENT_USER\Software\Microsoft\Office\ registry key so it can bypass the VB object model (VBOM) on a compromised host.^[116]

Rover has functionality to remove Registry Run key persistence as a cleanup procedure.^[117]

RTM can delete all Registry entries created during its execution.^[118]

ShadowPad maintains a configuration block and virtual file system in the Registry.^[119]

Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.^{[120][121][122]}

ShimRat has registered two registry keys for shim databases.^[123]

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.^[124]

Silence can create, delete, or modify a specified Registry key or value.^[125]

SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).^[126]

SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.^[127]

SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.^[128]

SOUNDBITE is capable of modifying the Registry.^[94]

StreamEx has the ability to modify the Registry.^[129]

Stuxnet can create registry keys to load driver files.^[130]

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\[service_name]\Start registry entries to value 4.^[131][132] It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.^[133]

SynAck can manipulate Registry keys.^[134]

SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.^[92]

Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.^[135]

TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers to enable document stealing.^[136]

TEARDROP modified the Registry to create a Windows service for itself on a compromised host.^[137]

A Threat Group-3390 tool has created new Registry keys under HKEY_CURRENT_USER\Software\Classes\ and HKLM\SYSTEM\CurrentControlSet\services.^[138][92]

ThreatNeedle can save its configuration data as the following RC4-encrypted Registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.^[139]

TinyTurla can set its configuration parameters in the Registry.^[140]

TrickBot can modify registry entries.^[141]

Turla has used the Registry to store encrypted payloads.^[142][143]

TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.^[144]

Ursnif has used Registry modifications as part of its installation routine.^[145][146]

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.^{[147][148][149]}

Volgmer stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.^[150][151]

WarzoneRAT can create HKCU\Software\Classes\Folder\shell\open\command as a new registry key during privilege escalation.^[152][153]

WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.^[154]

Waterbear has deleted certain values from the Registry to load a malicious DLL.^[155]

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory.^[156]

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.^[157]

zwShell can modify the Registry.^[158]

ZxShell can create Registry entries to enable services to run.^[159]

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.