Technique:  Modify Registry
During the 2015 Ukraine Electric Power Attack, It modified in-registry Internet settings to lower internet security before launching rundll32.exe, which in-turn launches the malware and communicates with C2 servers over the Internet. .
AADInternals can modify registry keys as part of setting a new pass-through authentication agent.
ADVSTORESHELL is capable of setting and deleting Registry values.
Agent Tesla can achieve persistence by modifying Registry key entries.
Amadey has overwritten registry keys for persistence.
It uses a Port 22 malware variant to modify several Registry keys.
It's backdoor has modified the Windows Registry to store the backdoor's configuration.
It uses a tool called CLEANTOAD that has the capability to modify Registry keys.
It used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Attor's dispatcher can modify the Run registry key.
Avaddon modifies several registry keys for persistence and UAC bypass.
BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.
BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\List.
Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.
Bisonal has deleted Registry keys to clean up its prior activity.
BitPaymer can set values in the Registry to help in execution.
Black Basta can modify the Registry to enable itself to run in safe mode and to modify the icons and file extensions for encrypted files.
BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters
It has used Windows Registry modifications to specify a DLL payload.
Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.
Catchamas creates three Registry keys to establish persistence by adding a Windows Service.
Caterpillar WebShell has a command to modify a Registry key.
Chaes can modify Registry values to stored information and establish persistence.
CharmPower can remove persistence-related artifacts from the Registry.
CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.
Clambling can set and delete Registry keys.
Clop can make modifications to Registry keys.
Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to enable the execution of additional code.
ComRAT has modified Registry values to store encrypted orchestrator code and payloads.
Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.
CrackMapExec can create a registry key using wdigest.
Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.
CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.
DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA="0" and HKEY_CURRENT_USER\Software\DC3_FEXEC.
DarkTortilla has modified registry keys for persistence.
DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.
DCSrv has created Registry keys for persistence.
It has modified the Registry to perform multiple techniques through the use of Reg.
It modified the registry using the command reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_SZ /d "[file path]" for persistence.
It has used an open source batch script to modify Windows Defender registry keys.
EVILNUM can make modifications to the Regsitry for persistence.
Exaramel for Windows adds the configuration to the Registry in XML format.
Explosive has a function to write itself to Registry values.
FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.
Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.
It has deleted Registry keys during post compromise cleanup activities.
It has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.
Gelsemium can modify the Registry to store its components.
gh0st RAT has altered the InstallTime subkey.
It malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.
Grandoreiro can modify the Registry to store its configuration at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.
GreyEnergy modifies conditions in the Registry and adds keys.
HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.
HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.
Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.
HyperStack can add the name of its communication pipe to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes.
InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.
KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.
It has modified Registry settings for default file associations to enable all macros and for persistence.
KOCTOPUS has added and deleted keys from the Registry.
KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’.
Lokibot has modified the Registry as part of its UAC bypass process.
It has used malware that adds Registry keys for persistence.
Mafalda can manipulate the system registry on a compromised host.
It has modified Registry settings for security tools.
MegaCortex has added entries to the Registry for ransom contact information.
metaMain can write the process ID of a target process into the HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid Registry value as part of its reflective loading activity.
Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.
Mori can write data to HKLM\Software\NFC\IPA and HKLM\Software\NFC\ and delete Registry values.
Mosquito can modify Registry keys under HKCU\Software\Microsoft[dllname] to store configuration values. Mosquito also modifies Registry keys under HKCR\CLSID...\InprocServer32 with a path to the launcher.
Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.
NanoCore has the capability to edit the Registry.
Neoichor has the ability to configure browser settings by modifying Registry entries under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer.
Nerex creates a Registry subkey that registers a new service.
Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE{8 random characters}.
NETWIRE can modify the Registry to store its configuration information.
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.
NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
njRAT can create, delete, or modify a specified Registry key or value.
During Operation Honeybee, the threat actors used batch files that modified registry keys.
During Operation Wocao, the threat actors enabled Wdigest by changing the HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest registry value from 0 (disabled) to 1 (enabled).
Orz can perform Registry operations.
Pandora can write an encrypted token to the Registry to enable processing of remote commands.
A It payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.
PcShare can delete its persistence mechanisms from the registry.
PHOREAL is capable of manipulating the Registry.
Pillowmint has modified the Registry key HKLM\SOFTWARE\Microsoft\DRM to store a malicious payload.
PipeMon has modified the Registry to store its encrypted payload.
PLAINTEE uses reg add to add a Registry Run key for persistence.
PlugX has a module to create, delete, or modify Registry keys.
PoetRAT has made registry modifications to alter its behavior upon execution.
PoisonIvy creates a Registry subkey that registers a new system device.
PolyglotDuke can write encrypted JSON configuration files to the Registry.
PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.
Prestige has the ability to register new registry keys for a new extension handler via HKCR\.enc and HKCR\enc\shell\open\command.
Pysa has modified the registry key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and added the ransom note.
QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.
QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.
QuasarRAT has a command to edit the Registry on the victim’s machine.
RCSession can write its configuration file to the Registry.
Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.
RegDuke can create seemingly legitimate Registry key to store its encryption key.
Regin appears to have functionality to modify remote Registry information.
Remcos has full control of the Registry, including the ability to modify it.
REvil can modify the Registry to save encryption parameters and system information.
ROKRAT can modify the HKEY_CURRENT_USER\Software\Microsoft\Office\ registry key so it can bypass the VB object model (VBOM) on a compromised host.
Rover has functionality to remove Registry Run key persistence as a cleanup procedure.
It can delete all Registry entries created during its execution.
ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.
Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.
ShimRat has registered two registry keys for shim databases.
Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.
It can create, delete, or modify a specified Registry key or value.
SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).
SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.
SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.
SOUNDBITE is capable of modifying the Registry.
StreamEx has the ability to modify the Registry.
Stuxnet can create registry keys to load driver files.
SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\[service_name]\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
SynAck can manipulate Registry keys.
SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.
It has used malware to disable Windows Defender through modification of the Registry.
Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.
TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers to enable document stealing.
Tarrask is able to delete the Security Descriptor (SD) registry subkey in order to "hide" scheduled tasks.
TEARDROP modified the Registry to create a Windows service for itself on a compromised host.
A It tool has created new Registry keys under HKEY_CURRENT_USER\Software\Classes\ and HKLM\SYSTEM\CurrentControlSet\services.
ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.
TinyIt can set its configuration parameters in the Registry.
TrickBot can modify registry entries.
It has modify Registry values to store payloads.
TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.
Uroburos can store configuration information in the Registry including the initialization vector and AES key needed to find and decrypt other Uroburos components.
Ursnif has used Registry modifications as part of its installation routine.
Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.
Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.
WarzoneRAT can create HKCU\Software\Classes\Folder\shell\open\command as a new registry key during privilege escalation.
WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.
Waterbear has deleted certain values from the Registry to load a malicious DLL.
It has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. It has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.
Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.
zwShell can modify the Registry.
ZxShell can create Registry entries to enable services to run.