Strrat

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Adversaries may check for Internet connectivity on compromised systems.

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.