🧩Registry API's

List of Registry API's used by Malware Dude :)

Malware often uses Windows Registry API functions to manipulate or access registry keys and values for various malicious purposes, such as persistence, hiding its presence, or configuring its behavior. Here’s a list of Registry APIs commonly exploited by malware:

1. RegOpenKeyEx: Opens a specified registry key, allowing malware to access or modify the contents of the key.

2. RegCreateKeyEx: Creates a new registry key or opens an existing key, which can be used to add or modify registry entries.

3. RegSetValueEx: Sets the data for a specified registry value, which can be used to store configuration data or persistence mechanisms.

4. RegQueryValueEx: Retrieves the data for a specified registry value, allowing malware to read configuration data or other information.

5. RegDeleteValue: Deletes a specified registry value, which can be used to remove evidence of malicious activity or disable security settings.

6. RegDeleteKey: Deletes a specified registry key, which can be used to remove registry entries associated with malware.

7. RegEnumKeyEx: Enumerates the subkeys of a specified registry key, allowing malware to explore and manipulate registry structures.

8. RegEnumValue: Enumerates the values of a specified registry key, which can be used to identify and manipulate existing registry values.

9. RegFlushKey: Writes any changes made to the registry key to disk, ensuring that modifications persist across system reboots.

10. RegLoadKey: Loads a registry hive from a file, allowing malware to modify or add registry data from external sources.

11. RegUnLoadKey: Unloads a registry hive, which can be used to remove or hide changes made to the registry.

12. RegOpenCurrentUser: Opens the registry key for the current user, which can be used to modify user-specific settings or persistence mechanisms.

13. RegOpenUserClassesRoot: Opens the registry key for user-specific settings related to file associations and application settings.

These APIs allow malware to interact with the Windows Registry in various ways, facilitating activities such as persistence, configuration, and evasion. Understanding these functions is crucial for developing effective detection and mitigation strategies.