Procedure examples

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.

Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.

BlackByte performed Registry modifications to escalate privileges and disable security tools.

Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence. Kimsuky has also modified the registry entry for `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` registry key for persistence with the name WindowsSecurityCheck.

Volt Typhoon has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).

A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`.

OilRig has used reg.exe to modify system configuration.

Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.

Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.

Turla has modified Registry values to store payloads.

TA505 has used malware to disable Windows Defender through modification of the Registry.

Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.

Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.

LuminousMoth has used malware that adds Registry keys for persistence.

APT42 has modified Registry keys to maintain persistence.

Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]” for persistence.

Silence can create, delete, or modify a specified Registry key or value.

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.

Magic Hound has modified Registry settings for security tools.

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.

FIN8 has deleted Registry keys during post compromise cleanup activities.

APT19 uses a Port 22 malware variant to modify several Registry keys.