Regger

Overview

Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necessarily direct data theft, but rather **sabotage and system degradation**. It manipulates critical registry keys to disable built-in security features, alter system policies, lower security zones, and pave the way for other, more destructive malware to execute without hindrance.

Understanding Regger
To an end-user, a Regger infection might manifest as a sudden inability to open Task Manager, a disabled Windows Defender, or constantly changing browser homepages. For a system administrator, Regger is a nuisance that attempts to un-harden the endpoint. It functions as an 'environment preparer', ensuring that subsequent malware payloads will not be blocked by OS-level defenses.

Execution and Registry Sabotage Mechanics
Regger is typically distributed as a secondary payload dropped by another downloader or via exploit kits. Upon execution, it does not rely on complex injection; instead, it uses standard Windows APIs (`RegSetValueEx`) to aggressively overwrite values (`T1112`). It specifically targets keys under `HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System` to set `DisableTaskMgr`, `DisableRegistryTools`, and `DisableCMD` to `1` (`T1562.001`). It may also modify `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender` to turn off Real-Time Protection. Furthermore, it alters Internet Explorer Security Zones, effectively lowering the barrier for drive-by downloads. By crippling these administrative and security tools, Regger ensures its own persistence and the survival of companion malware.

Indicators of Compromise & Impact
The impact is a severely compromised and vulnerable operating system. Host-based IoCs are highly specific: EDR alerts triggering on rapid, unauthorized modifications to critical `Policies` and `Windows Defender` registry hives. The user's inability to launch `regedit.exe` or `taskmgr.exe` is a classic symptom. Network IoCs may be minimal, as Regger's primary action is local system modification.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_REGGER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regger"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "regger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Regger (Trojan) Execution & Triage
id: 7a55f489-f6ae-5260-8f8c-e30b74ff0ab8
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Regger malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/regger
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1547_001
- attack.t1112
- attack.t1562_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_REGGER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regger tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "regger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network, as a Regger infection strongly implies other, more severe malware is being downloaded onto the un-hardened system.
2. Use a trusted, third-party offline registry editor or boot into Safe Mode to reverse the malicious policy changes and re-enable administrative tools.
3. Force a Group Policy update (`gpupdate /force`) if the machine is domain-joined to quickly re-apply corporate security baselines over the malware's changes.
4. Run a full anti-malware scan using an enterprise EDR solution to locate the executable responsible for making the registry changes.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the system is clean just because the registry keys were flipped back; the executable that made the changes must be found and removed.
2. Avoid manually editing the registry without a backup, as incorrect changes can render the Windows OS unbootable.

References & External Analysis

• Search "regger" on VirusTotal (External Analysis)
• Search "regger" on Any.Run (Sandbox Sandbox)
• Search "regger" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Vbclone
• Fakesmoke
• Ekstak
• Collector
• Miniduke
• Diztakun
• Miragefox
• Luhn

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/regger.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.