Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.^[55][56][57]

Agent Tesla can add itself to the Registry as a startup program to establish persistence.^[76]

APT18 establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.^[152][153]

An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.^[140]

APT29 added Registry Run keys to establish persistence.^[127]

APT3 places scripts in the startup folder for persistence.^[159]

APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.^{[156][157][158]}

APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.^[165][166]

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.^[132][133]

APT39 has maintained persistence using the startup folder. ^[164]

APT41 created and modified startup files for persistence.^[169] APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.^[170]

Aria-body has established persistence via the Startup folder or Run Registry key.^[123]

Astaroth creates a startup item for persistence. ^[101]

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.^[113]

Backdoor.Oldrea adds Registry Run keys to achieve persistence.^[18]

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.^[37]

BADNEWS installs a registry Run key to establish persistence.^[46]

BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.^[67]

BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.

Bisonal adds itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.^[91]

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.^[16]

Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.^[9]

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.^[146]

build_downer has the ability to add itself to the Registry Run key for persistence.^[126]

Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.^[36]

Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.^[26]

ChChes establishes persistence by adding a Registry Run key.^[42]

Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.^[147]

Cobian RAT creates an autostart Registry key to ensure persistence.^[85]

Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.^[15]

CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.^[35]

One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run^[43]

CrossRAT uses run keys for persistence on Windows

Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.^[145]

DarkComet adds several Registry entries to enable automatic execution at every system startup.^[50][51]

Darkhotel has been known to establish persistence by adding programs to the Run Registry key.^[161]

DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.^[17]

Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence.^[155]

DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.^[31]

If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.^[10][11]

Variants of Emissary have added Run Registry keys to establish persistence.^[38]

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.^[97][98][99]

Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.^[8]

EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.^[111]

EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.^[42]

FELIXROOT adds a shortcut file to the startup folder for persistence.^[63]

FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.^[143][8]

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.^[144]

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.^[162][163]

Final1stspy creates a Registry Run key to establish persistence.^[27]

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.^[87][88]

FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.^[37]

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.^[176]

Gazer can establish persistence by creating a .lnk file in the Start menu.^[19][20]

gh0st RAT adds a Registry Run key to establish persistence.^[81]

Gold Dragon establishes persistence in the Startup folder.^[40]

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.^[160]

GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.^[114]

Helminth establishes persistence by creating a shortcut in the Start Menu folder.^[52]

Hi-Zor creates a Registry Run key to establish persistence.^[72]

Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.^[149]

HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn "%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe" to establish persistence.^[47][48]

Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.^[171]

Some InnaputRAT variants establish persistence by modifying the Registry key HKU\\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.^[49]

Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.^[109]

JCry has created payloads in the Startup directory to maintain persistence. ^[110]

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.^[22]

Kasidet creates a Registry Run key to establish persistence.^[89][90]

Kazuar adds a sub-key under several Registry run keys.^[59]

Several Ke3chang backdoors achieved persistence by adding a Run key.^[148]

Kimsuky has placed scripts in the startup folder for persistence.^[167]

A version of KONNI drops a Windows shortcut into the Startup folder to establish persistence.^[66]

Lazarus Group malware attempts to maintain persistence by saving itself in the Start menu folder or by adding a Registry Run key.^{[134][135][136]}

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.^[138][139]

LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’ in order to execute its payload during Windows startup.^[112]

Machete used the startup folder for persistence.^[168]

Magic Hound malware has used Registry Run keys to establish persistence.^[150]

Matroyshka can establish persistence by adding Registry Run keys.^[12][13]

Metamorfo has written its executable path to the Registry Run key to achieve persistence.^[122]

Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.^[24]

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.^[174]

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.^[23]

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.^{[128][129][130][131]}

NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.^[65]

NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.^[68]

NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.^[53]

The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.^[37]

NETWIRE creates a Registry start-up entry to establish persistence.^[78]

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.^[105][106]

NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.^[79]

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.^[121]

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.^[141][142]

Pisloader establishes persistence via a Registry Run key.^[14]

PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.^[71]

PlugX adds Run key entries in the Registry to establish persistence.^[82][42][83]

PoetRAT has added a registry key in the hive for persistence.^[115]

PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.^[21]

PowerDuke achieves persistence by using various Registry Run keys.^[44]

PowerShower sets up persistence with a Registry run key.^[117]

POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.^[64]

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.^[4][5]

POWERTON can install a Registry Run key for persistence.^[100]

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.^[54]

Pteranodon copies itself to the Startup folder to establish persistence.^[58]

PUNCHBUGGY has been observed using a Registry Run key.^[29][30]

Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.^[6]

A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.^[151]

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.^[41]

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.^[42][75]

Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.^[7]

Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.^[102]

Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.^[103]

Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.^[116]

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.^[179]

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.^[33]

Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.^[73]

RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.^[45]

RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.^[45][172]

RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.^[40]

Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.^[120]

S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{{3 characters of Unique Identifier}}.^[61]

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.^[39]

SDBot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege. ^[124][125]

SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.^[84]

Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.^[25]

ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.^[104]

Sharpshooter's first-stage downloader installed Rising Sun to the startup folder %Startup%\mssync.exe.^[175]

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.^[119]

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.^[37]

Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.^[173]

Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.^[60]

SNUGRIDE establishes persistence through a Registry Run key.^[86]

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.^[37]

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.^[80]

Sykipot has been known to establish persistence by adding programs to the Run Registry key.^[74]

A Threat Group-3390 tool can add the binary’s path to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to add persistence.^[154]

TINYTYPHON installs itself under Registry Run key to establish persistence.^[46]

TinyZBot can create a shortcut in the Windows startup folder for persistence.^[32]

TrickBot establishes persistence in the Startup folder.^[28]

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.^[18]

Tropic Trooper has created shortcuts in the Startup folder to establish persistence.^[177][178]

Truvasys adds a Registry Run key to establish persistence.^[77]

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.^[23][137]

TURNEDUP is capable of writing to a Registry Run key to establish.^[34]

Ursnif has used Registry Run keys to establish automatic execution at system startup.^[107][108]

USBStealer registers itself under a Registry Run key with the name "USB Disk Security."^[62]

Vasport copies itself to disk and creates an associated run key Registry entry to establish.^[92]

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[a-f0-9A-F]{{8}} to maintain persistence.^[118]

Xbash can create a Startup item for persistence if it determines it is on a Windows system.^[96]

Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.^[93][94][95]

Zeus Panda adds persistence by creating Registry Run keys.^[69][70]