{
  "family": "regger",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necessarily direct data theft, but rather **sabotage and system degradation**. It manipulates critical registry keys to disable built-in security features, alter system policies, lower security zones, and pave the way for other, more destructive malware to execute without hindrance.<br><br><b>Understanding Regger</b><br>To an end-user, a Regger infection might manifest as a sudden inability to open Task Manager, a disabled Windows Defender, or constantly changing browser homepages. For a system administrator, Regger is a nuisance that attempts to un-harden the endpoint. It functions as an 'environment preparer', ensuring that subsequent malware payloads will not be blocked by OS-level defenses.<br><br><b>Execution and Registry Sabotage Mechanics</b><br>Regger is typically distributed as a secondary payload dropped by another downloader or via exploit kits. Upon execution, it does not rely on complex injection; instead, it uses standard Windows APIs (`RegSetValueEx`) to aggressively overwrite values (`T1112`). It specifically targets keys under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System` to set `DisableTaskMgr`, `DisableRegistryTools`, and `DisableCMD` to `1` (`T1562.001`). It may also modify `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender` to turn off Real-Time Protection. Furthermore, it alters Internet Explorer Security Zones, effectively lowering the barrier for drive-by downloads. By crippling these administrative and security tools, Regger ensures its own persistence and the survival of companion malware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely compromised and vulnerable operating system. Host-based IoCs are highly specific: EDR alerts triggering on rapid, unauthorized modifications to critical `Policies` and `Windows Defender` registry hives. The user's inability to launch `regedit.exe` or `taskmgr.exe` is a classic symptom. Network IoCs may be minimal, as Regger's primary action is local system modification.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1112",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry (Making aggressive changes to system policies)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling Task Manager, Regedit, Defender)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network, as a Regger infection strongly implies other, more severe malware is being downloaded onto the un-hardened system.",
    "Use a trusted, third-party offline registry editor or boot into Safe Mode to reverse the malicious policy changes and re-enable administrative tools.",
    "Force a Group Policy update (`gpupdate /force`) if the machine is domain-joined to quickly re-apply corporate security baselines over the malware's changes.",
    "Run a full anti-malware scan using an enterprise EDR solution to locate the executable responsible for making the registry changes."
  ],
  "what_to_avoid": [
    "Do not assume the system is clean just because the registry keys were flipped back; the executable that made the changes must be found and removed.",
    "Avoid manually editing the registry without a backup, as incorrect changes can render the Windows OS unbootable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}