{
  "family": "winreg",
  "sample_count": 8,
  "category": "trojan",
  "description": "Trojan:Win32/Winreg (often categorized generically as a **Registry Modifier**) is a classification for malware whose primary defining characteristic is the aggressive, unauthorized modification of the Windows Registry to establish deep persistence, cripple security software, or alter system behavior. While many trojans modify the registry, 'Winreg' designates threats where registry manipulation is the core mechanism of the attack.<br><br><b>Understanding Winreg Trojans</b><br>To an end-user, the infection might not be immediately obvious, though they may experience a suddenly disabled Task Manager or an inability to open the Registry Editor. For a security analyst, Winreg signifies a stealthy threat that is actively attempting to blind the operating system's defenses and embed itself so deeply that standard antivirus removal fails.<br><br><b>Execution and Registry Manipulation Mechanics</b><br>Winreg variants are typically dropped as secondary payloads (`T1105`). Upon execution, the malware heavily leverages the Windows API (e.g., `RegCreateKeyEx`, `RegSetValueEx`) to alter critical system configurations (`T1112`). Common actions include adding entries to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` for persistence (`T1547.001`). Crucially, Winreg often alters policies to disable user access to administrative tools, such as setting `DisableTaskMgr` or `DisableRegistryTools` to `1` (`T1562.001`). It may also modify Safe Mode configurations (`HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot`) to ensure it runs even in diagnostic modes, or alter file association keys so the malware executes every time a common file type (like `.txt` or `.exe`) is opened.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded security posture and the establishment of highly resilient persistence. The main IoCs are EDR alerts for anomalous registry modifications, particularly changes to the `Policies` hives or the `SafeBoot` keys by an unsigned or unknown process. Users reporting that 'Task Manager has been disabled by your administrator' is a classic symptom of a Winreg infection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1112",
    "T1546.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling TaskMgr/Regedit)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1546.001",
      "name": "Event Triggered Execution: Change Default File Association",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the trojan from downloading secondary payloads or communicating with its C2 server.",
    "Use an enterprise EDR solution or specialized removal tools to locate the malicious binary, as standard uninstallation methods will fail.",
    "Crucially, manually audit and repair the Windows Registry, reverting the malicious policy changes (re-enabling Task Manager, Regedit, and restoring Safe Mode keys).",
    "Perform a comprehensive scan to ensure no file associations were hijacked, which could lead to re-infection."
  ],
  "what_to_avoid": [
    "Do not assume the infection is removed just by deleting the malware executable; the altered registry keys will remain, leaving the system vulnerable or broken.",
    "Avoid attempting manual registry repairs without a backup, as incorrect changes can render the operating system unbootable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}