Registry-Segmented Payload Staging

A payload staging technique where a dropper splits a large string (Base64, hex, or raw) into fixed-size segments (typically 10 000–20 000 characters) and stores each segment as a separate REG_SZ value under a randomly named registry key. The segments are reassembled at execution time by iterating over the registry values in order.

What It Is

Instead of writing the full payload to disk or passing it entirely on a command line, the malware:

1. Generates a random directory/registry name (e.g., CowIcvikYJPdxrq).
2. Splits the payload into N segments of fixed length.
3. Writes each segment as HKCU\Software\<name>\donn\d0, d1, d2, etc.
4. The second-stage payload reads these values and concatenates them before decoding.

This evades command-line length limits, avoids writing large files to disk, and blends with normal registry noise under HKCU\Software.

Detection / Fingerprint

• Registry creation events under HKCU\Software\<random> with sequential value names (d0, d1, d2...).
• Values contain printable ASCII longer than typical registry data (10 000+ chars each).
• Parent process is wscript.exe or cscript.exe writing to registry.

Reproduce on Your Own VMs

$key = "HKCU:\Software\TestSeg"
$payload = "A" * 50000
$segSize = 19000
for ($i = 0; $i -lt [math]::Ceiling($payload.Length / $segSize); $i++) {
    $seg = $payload.Substring($i * $segSize, [math]::Min($segSize, $payload.Length - $i * $segSize))
    Set-ItemProperty -Path $key -Name "d$i" -Value $seg
}

Pages Where Observed

• unclassified-js-horus-dropper — JScript dropper using 19 000-char segments under HKCU\Software\CowIcvikYJPdxrq\donn\d*

References

• MITRE ATT&CK T1112: https://attack.mitre.org/techniques/T1112/