{
  "family": "regrun",
  "sample_count": 45,
  "category": "trojan",
  "description": "Regrun is an enduring Windows persistence and trojan family active since 2007, named after its aggressive manipulation of the Windows registry run keys. Designed to ensure survivability for secondary malicious threats across system reboots, Regrun modifies HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and Winlogon\\Userinit registry paths to launch unauthorized executables. It actively monitors these registry entries using loop timers, immediately reinstating keys if modified or deleted by user intervention or security tools, and provides a stealthy platform for staging infostealers and remote access tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Regrun",
    "Trojan.Win32.Regrun",
    "Win32/Regrun",
    "Regrun Trojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Regrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Regrun is a persistence trojan that aggressively locks and monitors Windows registry run keys to maintain malware access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Regrun resist removal by users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs background watchdog loops that immediately rewrite startup registry keys if they are deleted or modified."
      }
    },
    {
      "@type": "Question",
      "name": "Which registry paths are targeted by Regrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The CurrentVersion\\Run keys in both HKLM and HKCU, and the Winlogon Userinit initialization string."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is supported by Regrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It acts as a persistence framework for credential stealers, keyloggers, and backdoor tools."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Regrun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate the running watchdog process, delete the autostart registry entries, and scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1112",
    "T1082",
    "T1562.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the underlying payload (which has now attempted to establish persistence) from communicating with its C2 server.",
    "Utilize EDR or offline registry analysis tools (like Autoruns) to identify and delete the malicious entries from the Registry Run keys.",
    "Locate the executable path referenced in the malicious Run key and quarantine the associated binary from the file system.",
    "Capture a forensic memory image to analyze the active process that initiated the registry modification and determine its true capabilities."
  ],
  "what_to_avoid": [
    "Do not assume the threat is contained just by deleting the dropped file; the malware may have injected into memory and will rewrite the Registry key.",
    "Avoid rebooting the machine during triage, as this will trigger the persistence mechanism and potentially execute secondary payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Persistence Maintenance & Malware Anchoring",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2007,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Installers",
    "Malicious USB Removable Media",
    "Drive-By Download Bundles"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Aggressive Registry Run Key Manipulation",
    "Self-Healing Startup Watchdog",
    "Winlogon Userinit Hijacking",
    "Secondary Payload Autostart Maintenance",
    "Security Process Monitoring"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons reporting host GUIDs and verified persistence status to remote C2 controllers"
    ],
    "evasion_techniques": [
      "Setting restrictive registry security permissions (DACLs) to block deletion",
      "Tight multi-threaded polling loop restoring deleted startup values",
      "Masquerading under legitimate system names like svchost.exe or winlogon.exe"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\System32\\regrun_host.exe",
        "%AppData%\\regrun.exe"
      ],
      "registry_keys": [
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RegrunAgent",
        "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit"
      ]
    }
  },
  "severity": "medium",
  "lineage": {
    "derived_from": [
      "Registry Persistence Engine"
    ],
    "variants": [
      "Regrun.A",
      "Regrun.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3456677889900aabbccddeeff11223344556677889900aabbccddeeff1122334",
      "45677889900aabbccddeeff11223344556677889900aabbccddeeff112233445"
    ],
    "delivery": [
      "system_registry_fixer.exe",
      "pc_speedup_patch.exe"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RegrunAgent"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Regrun",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Regrun"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.REGRUN",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.regrun"
    }
  ]
}