Detects DonutLoader

Family: DonutLoader

DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Sets service image path in registry

This determines the executable launched when a service starts. It can be used to establish persistence.