T1547.001 Registry Run Keys / Startup Folder in real malware

ATT&CK technique T1547.001 Registry Run Keys / Startup Folder appears in 1844 publicly analyzed samples on MalwareAnalyzer by Cyble, 1.6% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: Razy, Zusy, Fugrafa, Fsysna.

Tactics: persistence, privilege-escalation

Prevalence in the corpus

• Samples exhibiting T1547.001: 1844
• Share of analyzed corpus: 1.6%
• Last 7 days: 0 · prior 7 days: 0 (flat)

Malware families using T1547.001

• Razy - 127 samples
• Zusy - 92 samples
• Fugrafa - 69 samples
• Fsysna - 67 samples

Example samples

• KeePass.exe - malicious
• 6f12737726a472c954e802a646ea7d0d197f7d04b24c35fe643da9bab07f461e - malicious
• 75aecef91184b22ef1afe3bdb0ae8c3072dfe1fa08356dd13e2c9899dc7eaf2e - malicious
• 84a2afed6c23787ac1ae8f8bd30749a61a6cc16508cf8cc014f58b1e4d8d1384 - malicious
• 3e22901e7b039f8e5f0abf40183e598b61c97eae4c8e518c5053be9bea070fe3 - malicious
• e66b9c42a98a552f5e4189ed22540f13823fac905f929eda4eb12d552b2bbed3 - malicious
• af569ee985a279ead6234b61ce1957557eb573ae067d06d2c1ab77eda4c4f72d - malicious
• 287653416860dce2eadab89c620b48f6933d7de8b89500ca8fb356b68a8ecb89 - malicious
• 46cfeb049ec1b54df89c49003c2b772750bbcd89e6ebb235bf1861771a6613a3 - malicious
• 5aa10feeb2b1dbbb3b4b7c8503ad6916fe8301d6122be09556be5b1cf10dd56e - malicious
• bae6157ecc8725f45770344bd174e6eef095660d3b89e042130bb154909e95ad - malicious
• 8d426aeabdb126c6af992785f00d1dbc176142905c4fa281bb2b6eb6b28b0fe3 - malicious
• 17c8e5e3d023aa0549f3fcbae7fa1e56cd3a57806dac37b8eaac4a725b29fa8d - malicious
• cbe7e7925d3dddb228f61f1ebe6a9008cd14eb403a718330218d72dbfabb36e0 - malicious
• 0aa16df38d44af2e5d29d58fe212c6460a2b4ea000cfe23a3c0333391ccd397d - malicious
• a8b70d8d3a3f70e6683db5dc31933fc9f004f37d869fb212f7068dae2d4d9fb2 - malicious
• TmCCSF.exe - malicious
• e90ebab1189bde368929f30615cfa89958263e3a96216e9ea355651ae5eb844d - malicious
• 68c6c55994f17e6ed8b6a05c92aca51b9fee6dc17179c1e0f8c962819e21d40b - malicious
• 980ec9a2a588af5fb49c65bcc958a98e3ee3b25c81f433acc7eacdbc4864d511 - malicious
• 0e5b7823bd4564ef25ad6bf8c9029a3e2eaec88ffe11ec6afe5bdc75c112360d - malicious
• a1081854e7251145d10d5dac68ea93a1989f6103b176ac7cd4448c28b9b5e3e0 - malicious
• dfe4289cc8e59df3312af9e39456f74f89a1a6c24c000b57ee6a3e86acd63115 - malicious
• ae0b00f1b014d3902edc770dda0d612e237d90f63982343dfd1edeb4138533e2 - malicious
• 36870b8a271a92daf949918a9214caa6e9a59bfa0d8b5a079e3039445a86bdbc - malicious

Canonical technique definition: MITRE ATT&CK T1547.001 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1547.001

How common is ATT&CK T1547.001 (Registry Run Keys / Startup Folder) in real malware?

ATT&CK technique T1547.001 Registry Run Keys / Startup Folder appears in 1844 publicly analyzed samples on MalwareAnalyzer by Cyble, 1.6% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: Razy, Zusy, Fugrafa, Fsysna.

Which malware families use T1547.001?

In this corpus T1547.001 is most associated with Razy (127), Zusy (92), Fugrafa (69), Fsysna (67). Counts are analyzed samples per family in which the technique was observed.

What share of analyzed samples use T1547.001?

1.6% of the publicly analyzed corpus (1844 of 114609 samples) exhibits T1547.001. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats