ID	F0012
Objective(s)	Persistence
Related ATT&CK Techniques	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Version	2.1
Created	2 August 2022
Last Modified	13 September 2023

Registry Run Keys / Startup Folder

Malware may add an entry to the Windows Registry run keys or startup folder to enable persistence. [1]

See ATT&CK: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001).

Use in Malware

Name	Date	Method	Description
TrickBot	2016	--	The malware has an auto-start service that allows it to run whenever the machine boots. [16]
Poison Ivy	2005	--	To start itself at system boot, Poison Ivy adds registry entries. [2]
Hupigon	2013	--	Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [3]
Hupigon	2013	--	Hupigon persists via Run registry key. [3]
Terminator	2013	--	The Terminator RAT sets "2019" as Windows' startup folder by modifying a registry value. [4]
CryptoLocker	2013	--	The malware creates an "autorun" registry key. [5]
GoBotKR	2019	--	GoBotKR installs itself under registry run keys to establish persistence. [6]
Kovter	2016	--	The malware writes an autorun registry entry. [7]
Rombertik	2015	--	The malware will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off Rombertik every time the user logs in, and places the script into the user’s Startup folder. [8]
Ursnif	2016	--	The malware adds registry entries to ensure automatic execution at system startup. [9]
BlackEnergy	2007	--	BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder, allowing it to persist via a Run registry key. [10] [17]
Conficker	2008	--	To start itself at system boot, the virus saves a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service. [11]
DarkComet	2008	--	DarkComet adds several registry entries to enable automatic execution at startup. [12]
Emotet	2018	--	To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [13]
Bagle	2004	--	Bagle adds registry keys to enable its automatic execution at every system startup. [14]
Vobfus	2016	--	Malware adds registry keys to enable startup after reboot. [15]
Redhip	2011	--	Redhip persists via a Run registry key. [17]
WannaCry	2017	--	WannaCry creates two registry run keys to ensure persistence. [18]
CryptoWall	A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [19]