{
  "family": "regsup",
  "sample_count": 296,
  "category": "trojan_generic",
  "description": "Trojan:Win32/Regsup is a specialized malware variant designed to aggressively modify Windows Registry security settings, actively disabling built-in defenses to pave the way for secondary payloads.<br><br><b>Understanding Regsup</b><br>To an end-user, a Regsup infection might manifest as a sudden inability to open Windows Defender or run antivirus scans. For incident responders, Regsup is a critical 'Defense Impairment' tool. Its primary function is not to steal data itself, but to systematically tear down the endpoint's security posture—disabling UAC, shutting down Windows Update, and neutralizing active AV engines.<br><br><b>Execution and Evasion Strategies</b><br>Regsup is typically dropped as a precursor payload by larger botnets or exploit kits. Upon execution, it immediately targets the <code>HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender</code> and <code>HKLM\\SOFTWARE\\Microsoft\\Security Center</code> registry hives. It injects values like <code>DisableAntiSpyware</code> and forcefully stops critical security services via the command line (e.g., <code>net stop WinDefend</code>). Regsup establishes persistence via Run keys to ensure defenses remain down even after a reboot.<br><br><b>Indicators of Compromise (IoCs)</b><br>The impact of Regsup is a completely vulnerable endpoint. Threat hunters will observe a massive spike in EDR alerts relating to 'Registry Modification - Security Controls' or 'Service Termination'. Incident responders should immediately investigate any endpoint where Windows Security Center reports that protection has been unexpectedly turned off by an 'Administrator'. Network logs will quickly show the subsequent download of severe secondary payloads like ransomware.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1059.003",
    "T1562.001",
    "T1489",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if Regsup has successfully disabled defenses, secondary destructive payloads are likely already downloading.",
    "Deploy a scripted Group Policy update to forcefully re-enable Windows Defender, UAC, and Security Center services across the domain.",
    "Utilize a known-good, offline AV scanner (Live CD) to identify and remove the Regsup persistence mechanisms in the registry.",
    "Assume the endpoint is severely compromised and perform a full forensic analysis to identify any payloads dropped while defenses were down."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe simply because you re-enabled the AV; Regsup's persistence mechanisms will likely disable it again on reboot.",
    "Avoid ignoring 'AV Disabled' alerts in the SOC; they are frequently the first indicator of a massive, impending ransomware deployment."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}