Obfuscated Files or Information: Fileless Storage

APT32's backdoor has stored its configuration in a registry key.^[3]

Some versions of Chaes stored its instructions (otherwise in a instructions.ini file) in the Registry.^[4]

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.^[5]

ComRAT has stored encrypted orchestrator code and payloads in the Registry.^[6][7]

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.^[8]

Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.^[9]

Gelsemium can store its components in the Registry.^[10]

Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.^[11]

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname].^[12]

NETWIRE can store its configuration information in the Registry under HKCU:\Software\Netwire.^[13]

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.^[14]

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.^[15]

PipeMon has stored its encrypted payload in the Registry under HKLM\SOFTWARE\Microsoft\Print\Components\.^[16]

PolyglotDuke can store encrypted JSON configuration files in the Registry.^[17]

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.^[18][19]

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as HKCU\Office365DCOMCheck) in the HKCU hive.^[20]

RCSession can store its obfuscated configuration file in the Registry under HKLM\SOFTWARE\Plus or HKCU\SOFTWARE\Plus.^[21][22]

RegDuke can store its encryption key in the Registry.^[17]

REvil can save encryption parameters and system information in the Registry.^{[23][24][25][26][27]}

ShadowPad maintains a configuration block and virtual file system in the Registry.^[28][29]

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.^[30]

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.^[31]

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.^[32]

TinyTurla can save its configuration parameters in the Registry.^[33]

Turla has used the Registry to store encrypted and encoded payloads.^[34][35]

TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.^[36]

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.^[37]

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.^[38][39][40]

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.^[41][42]

Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.