CRITICAL

Multi-Vector Persistence

The simplest and most common form of Windows persistence. Malware writes its file path to HKCU\Software\Microsoft\Windows\CurrentVersion\Run so it executes every time the user logs in.

Registry Editor

Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
- Software
  - Microsoft
    - Windows
      - CurrentVersion
        Run
        RunOnce
HKEY_USERS

Name	Type	Data
(Default)	REG_SZ	(value not set)
SecurityHealth	REG_EXPAND_SZ	%windir%\system32\SecurityHealthSystray.exe

Phase 1 of 3

Registry Run Keys