Reg — Malware Profile

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. Utilities such as Reg are known to be used by persistent threats.

MITRE ATT&CK techniques (3)

• T1012 Query Registry
• T1112 Modify Registry
• T1552.002 Credentials in Registry

Attributed threat actors

• Dragonfly
• OilRig
• Turla
• GALLIUM
• Daggerfly
• Gamaredon Group
• Rancor
• Volt Typhoon

Read the full analysis on IntelFusions