Obfuscated Files or Information: Fileless Storage

APT32's backdoor has stored its configuration in a registry key.^[7]

Some versions of Chaes stored its instructions (otherwise in a instructions.ini file) in the Registry.^[8]

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.^[9]

ComRAT has stored encrypted orchestrator code and payloads in the Registry.^[10][11]

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.^[12]

Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.^[13]

Gelsemium can store its components in the Registry.^[14]

Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.^[15]

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname].^[16]

NETWIRE can store its configuration information in the Registry under HKCU:\Software\Netwire.^[17]

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.^[18]

Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.^[19]

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.^[20]

PipeMon has stored its encrypted payload in the Registry under HKLM\SOFTWARE\Microsoft\Print\Components\.^[21]

PolyglotDuke can store encrypted JSON configuration files in the Registry.^[22]

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.^[23][24]

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as HKCU\Office365DCOMCheck) in the HKCU hive.^[25]

RCSession can store its obfuscated configuration file in the Registry under HKLM\SOFTWARE\Plus or HKCU\SOFTWARE\Plus.^[26][27]

RegDuke can store its encryption key in the Registry.^[22]

REvil can save encryption parameters and system information in the Registry.^{[28][29][30][31][32]}

ShadowPad maintains a configuration block and virtual file system in the Registry.^[33][34]

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.^[35]

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.^[36]

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.^[37]

TinyTurla can save its configuration parameters in the Registry.^[38]

Turla has used the Registry to store encrypted and encoded payloads.^[39][40]

TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.^[41]

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.^[42]

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.^[43][44][45]

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.^[46][47]

Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.