Technique:  Obfuscated Files or Information:Fileless Storage
It's backdoor has stored its configuration in a registry key.
Some versions of Chaes stored its instructions (otherwise in a instructions.ini file) in the Registry.
CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.
ComRAT has stored encrypted orchestrator code and payloads in the Registry.
DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.
Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.
Gelsemium can store its components in the Registry.
Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.
Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname].
NETWIRE can store its configuration information in the Registry under HKCU:\Software\Netwire.
During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.
Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.
PipeMon has stored its encrypted payload in the Registry under HKLM\SOFTWARE\Microsoft\Print\Components\.
PolyglotDuke can store encrypted JSON configuration files in the Registry.
QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.
QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as HKCU\Office365DCOMCheck) in the HKCU hive.
RCSession can store its obfuscated configuration file in the Registry under HKLM\SOFTWARE\Plus or HKCU\SOFTWARE\Plus.
RegDuke can store its encryption key in the Registry.
REvil can save encryption parameters and system information in the Registry.
ShadowPad maintains a configuration block and virtual file system in the Registry.
Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.
SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.
ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.
TinyIt can save its configuration parameters in the Registry.
It has used the Registry to store encrypted and encoded payloads.
TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.
Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.
Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.
Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.