Performing Malware Persistence Investigation

When to Use

• When investigating how malware maintains presence on a compromised system after reboots
• During incident response to identify all persistence mechanisms for complete remediation
• For threat hunting to discover unauthorized autostart entries across endpoints
• When analyzing malware behavior to understand its persistence strategy
• For verifying that all persistence has been removed after incident remediation

Prerequisites

• Forensic image or live system access with administrative privileges
• Autoruns (Sysinternals) for Windows persistence enumeration
• RegRipper for offline registry analysis
• Understanding of Windows and Linux persistence mechanisms
• YARA rules for scanning persistence locations
• Baseline of known-good autorun entries for comparison

Workflow

Step 1: Enumerate Windows Registry Persistence

# Extract registry hives from forensic image
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence

# Key registry persistence locations
python3 << 'PYEOF'
from Registry import Registry
import json

results = {'registry_persistence': []}

# SYSTEM hive analysis
system_reg = Registry.Registry("/cases/case-2024-001/registry/SYSTEM")
select = system_reg.open("Select")
current = select.value("Current").value()
cs = f"ControlSet{current:03d}"

# Services (very common persistence)
services = system_reg.open(f"{cs}\\Services")
for svc in services.subkeys():
    try:
        start_type = svc.value("Start").value()
        image_path = ""
        try:
            image_path = svc.value("ImagePath").value()
        except:
            pass
        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled
        if start_type in (0, 1, 2) and image_path:
            svc_type = svc.value("Type").value() if svc.values() else 0
            results['registry_persistence'].append({
                'location': f'HKLM\\SYSTEM\\{cs}\\Services\\{svc.name()}',
                'type': 'Service',
                'value': image_path,
                'start_type': start_type,
                'timestamp': str(svc.timestamp())
            })
    except Exception:
        pass

# SOFTWARE hive analysis
sw_reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE")

# Machine Run keys
run_keys = [
    "Microsoft\\Windows\\CurrentVersion\\Run",
    "Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "Microsoft\\Windows\\CurrentVersion\\RunServices",
    "Microsoft\\Windows\\CurrentVersion\\RunServicesOnce",
    "Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
    "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
]

for key_path in run_keys:
    try:
        key = sw_reg.open(key_path)
        for value in key.values():
            results['registry_persistence'].append({
                'location': f'HKLM\\SOFTWARE\\{key_path}',
                'type': 'Run Key',
                'name': value.name(),
                'value': str(value.value()),
                'timestamp': str(key.timestamp())
            })
    except Exception:
        pass

# NTUSER.DAT analysis
import glob
for ntuser in glob.glob("/cases/case-2024-001/registry/NTUSER*.DAT"):
    try:
        user_reg = Registry.Registry(ntuser)
        user_run_keys = [
            "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
            "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
            "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
        ]
        for key_path in user_run_keys:
            try:
                key = user_reg.open(key_path)
                for value in key.values():
                    results['registry_persistence'].append({
                        'location': f'HKCU\\{key_path}',
                        'type': 'User Run Key',
                        'name': value.name(),
                        'value': str(value.value()),
                        'timestamp': str(key.timestamp()),
                        'hive': ntuser
                    })
            except Exception:
                pass
    except Exception:
        pass

print(f"Total registry persistence entries: {len(results['registry_persistence'])}")
for entry in results['registry_persistence']:
    print(f"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}")


…