Regrun

Overview

Trojan:Win32/Regrun is a heuristic detection utilized by antivirus engines to flag executables that aggressively and suspiciously modify the Windows Registry—specifically the 'Run' and 'RunOnce' keys—to establish persistent execution upon system boot.

Understanding Regrun
To the user, this is a standard security alert. For a security analyst, a 'Regrun' detection highlights a critical behavioral anomaly. While legitimate software uses the Registry Run keys (`HKLM\Software\Microsoft\Windows\CurrentVersion\Run`), malware abuses them almost universally (`T1547.001`). The AV engine triggers this heuristic when a newly dropped, unknown executable attempts to forcibly insert itself into these autostart locations, often using randomized filenames or attempting to overwrite existing, legitimate entries.

Execution and Evasion Strategies
Because it is a behavioral heuristic, the underlying payload could be anything: adware, a RAT, or a botnet agent. The infection vector varies wildly. The critical action is the persistence mechanism. The malware drops its payload (often into `%AppData%` or `%Temp%`) and immediately calls the Windows API (`RegCreateKeyEx`, `RegSetValueEx`) to ensure it survives a reboot. Advanced variants may utilize 'Registry hooking' to intercept attempts by security software to read or delete the malicious Run key, essentially blinding the AV to its presence.

Indicators of Compromise & Impact
The impact depends on the payload that achieved persistence. EDR platforms are highly effective at detecting this behavior, logging the specific process that initiated the unauthorized registry modification. Incident responders should immediately audit the `Run`, `RunOnce`, `RunServices`, and `Userinit` keys within the Registry. The presence of randomly named executables pointing to temporary directories within these keys is a definitive IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.005: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.
• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REGRUN {
    meta:
        description = "Detects Regrun (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "regrun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Regrun Activity
id: 77b8da3149070b80cbb7b64589f4da4c
status: experimental
description: Detects generic indicators of the regrun malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*regrun*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to prevent the underlying payload (which has now attempted to establish persistence) from communicating with its C2 server.
2. Utilize EDR or offline registry analysis tools (like Autoruns) to identify and delete the malicious entries from the Registry Run keys.
3. Locate the executable path referenced in the malicious Run key and quarantine the associated binary from the file system.
4. Capture a forensic memory image to analyze the active process that initiated the registry modification and determine its true capabilities.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is contained just by deleting the dropped file; the malware may have injected into memory and will rewrite the Registry key.
2. Avoid rebooting the machine during triage, as this will trigger the persistence mechanism and potentially execute secondary payloads.

References & External Analysis

• Search "regrun" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Multiinjector
• Frethog
• Cardspy
• Browserpwdstealer
• Cutwail

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/regrun.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.