Modify Registry

ADVSTORESHELL is capable of setting and deleting Registry values.^[6]

APT19 uses a Port 22 malware variant to modify several Registry keys.^[7]

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration. ^[8]

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.^[9]

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.^[10]

Attor's dispatcher can modify the Run registry key.^[11]

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.^[12]

BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\List.^[13]

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.^[14]

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.^[15]

Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.^[16]

Catchamas creates three Registry keys to establish persistence by adding a New Service.^[17]

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.^[18]

ComRAT has encrypted and stored its orchestrator code in the Registry.^[19]

CrackMapExec can create a registry key using wdigest.^[20]

DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA="0" and HKEY_CURRENT_USER\Software\DC3_FEXEC.^[21][22]

Dragonfly 2.0 modified the Registry to perform multiple techniques through the use of Reg.^[23]

Exaramel for Windows adds the configuration to the Registry in XML format.^[24]

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.^[25]

FIN8 has deleted Registry keys during post compromise cleanup activities.^[26]

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.^[27]

gh0st RAT has altered the InstallTime subkey.^[28]

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.^[29]

GreyEnergy modifies conditions in the Registry and adds keys.^[30]

Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.^[31]

HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.^[32]

Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.^[33][34]

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.^[35][36]

KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.^[37]

KONNI has modified registry keys of ComSysApp service and Svchost on the machine to gain persistence.^[38]

Lazarus Group has modified registry keys using the reg windows utility for its custom backdoor implants.^[39]

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’.^[40]

Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.^[41][42][43]

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname] and modifies Registry keys under HKCR\CLSID...\InprocServer32with a path to the launcher.^[44]

Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.^[45]

NanoCore has the capability to edit the Registry.^[46][47]

Nerex creates a Registry subkey that registers a new service.^[48]

Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE{{8 random characters}}.^[49]

njRAT can create, delete, or modify a specified Registry key or value.^[50][51]

A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.^[52]

PHOREAL is capable of manipulating the Registry.^[53]

Pillowmint has stored its malicious payload in the registry key HKLM\SOFTWARE\Microsoft\DRM.^[54]

PipeMon has stored its encrypted payload in the Registry.^[55]

PLAINTEE uses reg add to add a Registry Run key for persistence.^[56]

PlugX has a module to create, delete, or modify Registry keys.^[57]

PoetRAT has made registry modifications to alter its behavior upon execution.^[58]

PoisonIvy creates a Registry subkey that registers a new system device.^[59]

PolyglotDuke can write encrypted JSON configuration files to the Registry.^[60]

PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.^[61]

QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.^[62]

QuasarRAT has a command to edit the Registry on the victim’s machine.^[63]

Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.^[1]

RegDuke can store its encryption key in the Registry.^[60]

Regin appears to have functionality to modify remote Registry information.^[64]

Remcos has full control of the Registry, including the ability to modify it.^[65]

REvil can save encryption parameters and system information to the Registry.^{[66][67][68][69][70]}

Rover has functionality to remove Registry Run key persistence as a cleanup procedure.^[71]

RTM can delete all Registry entries created during its execution.^[72]

Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.^[73][74][75]

ShimRat has registered two registry keys for shim databases.^[76]

Silence can create, delete, or modify a specified Registry key or value.^[77]

SOUNDBITE is capable of modifying the Registry.^[53]

StreamEx has the ability to modify the Registry.^[78]

Sunburst had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\[service_name]\Start registry entries to value 4.^[79][80] It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.^[81]

SynAck can manipulate Registry keys.^[82]

TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers to enable document stealing.^[83]

Teardrop modified the Registry to create a Windows service for itself on a compromised host.^[84]

A Threat Group-3390 tool can create a new Registry key under HKEY_CURRENT_USER\Software\Classes\.^[85]

TrickBot can modify registry entries.^[86]

Turla has used the Registry to store encrypted payloads.^[87][88]

TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.^[89]

Ursnif has used Registry modifications as part of its installation routine.^[90][91]

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.^[92][93][94]

Volgmer stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.^[95][96]

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory.^[97]

Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.^[98]

zwShell can modify the Registry.^[99]

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.