T1112 Modify Registry in real malware
ATT&CK technique T1112 Modify Registry appears in 7673 publicly analyzed samples on MalwareAnalyzer by Cyble, 7.6% of the analyzed corpus. Seven-day prevalence is falling (1124 recent vs 1717 prior). Most associated families: Zusy, Mira, VJadtre, HUILoader.
Tactics: defense-impairment, persistence
Prevalence in the corpus
- Samples exhibiting T1112: 7673
- Share of analyzed corpus: 7.6%
- Last 7 days: 1124 · prior 7 days: 1717 (falling)
Malware families using T1112
Example samples
- b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0 - malicious
- 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7 - malicious
- 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823 - malicious
- b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455 - malicious
- db79ee24eba89e92e85d48d397b219af73aea31e6451724a8975106ff84f00b4 - malicious
- 1d743eba105b5336d26bcc5ab62bbb4f7f89904c1b763aa4719576e347dfc9d2 - malicious
- 83358f4c1bae1867fd7f19f4fe25f035f2c49e45c2092c181ba8d7370724d6b2 - malicious
- 4eaf8dbd0b9d67dcfc003192b8d975c891182e95681c7f2122a47cb0422fe982 - malicious
- c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc - malicious
- a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b - malicious
- 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001 - malicious
- 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469 - malicious
- 3f27d02f78d50015562f97ca135c3566a4ba2688752d826fda1a4a4186a2b8e2 - malicious
- cdd298849c4406b391d5604c6d17cccef45d98354cfee956193c818c9ac3b63e - malicious
- f6c0f5fa9aff1e9b96727af92a43b7e122add296e98013d449f3facf84c0f6a9 - malicious
- 9fb175ba2665fd5e9156c56baf7537230abce85204efbce8001f09fd2c876d65 - malicious
- 96c234261ed29a340c8e75e807f2cb79575d4db12ecd00f11a7b245f13d21eae - malicious
- 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5 - malicious
- f428d4b689ac95dcd2872c008340cbb3487acfe4f010e072279fb8a7e82cb9ea - malicious
- a5a167b4f070315f4db61058cc70c2f6f55fa39926f1a2b2af310f3558bd2462 - malicious
- ce71816c9cb0587794218a2eb333b3b4d3676074b73e3fe9e88db3e7498c6acd - malicious
- 86ae940c8e2fcc14fb843eafc594ea439504f7935465767d354735e5134fab59 - malicious
- 5f0dd09b0b3d1a5be77992519ee99a0ecee8c945431e00b96e9c626da59594d1 - malicious
- e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88 - malicious
- c23e29bd44aa683f4ca790fdfdef8134dfe709d9272ba83bedae4104aea2db74 - malicious
Canonical technique definition: MITRE ATT&CK T1112 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1112
- How common is ATT&CK T1112 (Modify Registry) in real malware?
- ATT&CK technique T1112 Modify Registry appears in 7673 publicly analyzed samples on MalwareAnalyzer by Cyble, 7.6% of the analyzed corpus. Seven-day prevalence is falling (1124 recent vs 1717 prior). Most associated families: Zusy, Mira, VJadtre, HUILoader.
- Is T1112 becoming more common?
- Prevalence is falling: 1124 samples in the last seven days against 1717 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1112?
- In this corpus T1112 is most associated with Zusy (406), Mira (196), VJadtre (145), HUILoader (134). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1112?
- 7.6% of the publicly analyzed corpus (7673 of 100953 samples) exhibits T1112. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats