{
  "family": "regger",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necessarily direct data theft, but rather **sabotage and system degradation**. It manipulates critical registry keys to disable built-in security features, alter system policies, lower security zones, and pave the way for other, more destructive malware to execute without hindrance.<br><br><b>Understanding Regger</b><br>To an end-user, a Regger infection might manifest as a sudden inability to open Task Manager, a disabled Windows Defender, or constantly changing browser homepages. For a system administrator, Regger is a nuisance that attempts to un-harden the endpoint. It functions as an 'environment preparer', ensuring that subsequent malware payloads will not be blocked by OS-level defenses.<br><br><b>Execution and Registry Sabotage Mechanics</b><br>Regger is typically distributed as a secondary payload dropped by another downloader or via exploit kits. Upon execution, it does not rely on complex injection; instead, it uses standard Windows APIs (`RegSetValueEx`) to aggressively overwrite values (`T1112`). It specifically targets keys under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System` to set `DisableTaskMgr`, `DisableRegistryTools`, and `DisableCMD` to `1` (`T1562.001`). It may also modify `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender` to turn off Real-Time Protection. Furthermore, it alters Internet Explorer Security Zones, effectively lowering the barrier for drive-by downloads. By crippling these administrative and security tools, Regger ensures its own persistence and the survival of companion malware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely compromised and vulnerable operating system. Host-based IoCs are highly specific: EDR alerts triggering on rapid, unauthorized modifications to critical `Policies` and `Windows Defender` registry hives. The user's inability to launch `regedit.exe` or `taskmgr.exe` is a classic symptom. Network IoCs may be minimal, as Regger's primary action is local system modification.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Regger and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Regger is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Regger establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Regger typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Regger compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Regger should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Regger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Regger frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Regger across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Regger by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1112",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry (Making aggressive changes to system policies)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling Task Manager, Regedit, Defender)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network, as a Regger infection strongly implies other, more severe malware is being downloaded onto the un-hardened system.",
    "Use a trusted, third-party offline registry editor or boot into Safe Mode to reverse the malicious policy changes and re-enable administrative tools.",
    "Force a Group Policy update (`gpupdate /force`) if the machine is domain-joined to quickly re-apply corporate security baselines over the malware's changes.",
    "Run a full anti-malware scan using an enterprise EDR solution to locate the executable responsible for making the registry changes."
  ],
  "what_to_avoid": [
    "Do not assume the system is clean just because the registry keys were flipped back; the executable that made the changes must be found and removed.",
    "Avoid manually editing the registry without a backup, as incorrect changes can render the Windows OS unbootable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}