Windows Registry Forensics

Windows Registry Forensics

When to Use

• When triaging a compromised Windows workstation during a major incident to determine exactly which malicious executables ran, when they ran, and what specific USB devices were inserted.
• To detect long-term, stealthy malware persistence using obscure "Run" keys or Service entries hidden deep within the SOFTWARE or SYSTEM hives.
• To reconstruct an attacker's lateral movement paths across the domain by parsing their historical RDP connections, MRU (Most Recently Used) jump lists, and typed URLs within NTUSER.DAT.

Prerequisites

• Forensic image or live access to the affected system(s)
• Forensic workstation with analysis tools (Autopsy, Volatility, Timeline Explorer)
• Chain of custody documentation initiated for evidence handling
• Write-blocker for disk forensics or memory acquisition tool (e.g., DumpIt, WinPmem)

Workflow

Phase 1: Acquiring the Hives (Live Triage)

# Concept: The Registry hives are strictly locked by the Windows Kernel while the OS is running.
# You cannot simply 'copy' them. You must acquire them via KAPE, Volume Shadow Copies (VSS), 
# or specialized extraction tools.

# System-wide Hives (Located at `C:\Windows\System32\config`):
# - SYSTEM (System config, Network interfaces, Devices)
# - SOFTWARE (Installed applications, Global Run keys)
# - SAM (Local User Accounts & NTLM password hashes)
# - SECURITY (LSA Policies, User Rights)
# - Amcache.hve (Application Execution Cache)

# User-specific Hive (Located at `C:\Users\<Username>\`):
# - NTUSER.DAT (User configuration, Typed Paths, UserAssist, Recent Docs)

# 1. Extraction via KAPE (Kroll Artifact Parser and Extractor):
kape.exe --tsource C: --target RegistryHives --tdest C:\Triage_Data\

Phase 2: Evidence of Execution (Amcache & ShimCache)

# Concept: Did the malware execute? If the attacker deleted `malware.exe`, the Registry 
# still vividly remembers that it *was* there and *ran* months ago via compatibility caches.

# 1. Parsing the Amcache (Amcache.hve)
# This hive meticulously records the SHA1 hash, absolute path, File size, and First Execution Time 
# of virtually every single executable run on Windows 10/11.
# Analysis Tool: Load `Amcache.hve` into Eric Zimmerman's Registry Explorer or run RegRipper.
# Path: Root\InventoryApplicationFile
# Result: Discovery of `C:\Windows\Temp\payload.exe` executed at 2024-03-12 02:45 UTC with SHA1 hash `F8B...`.

# 2. Parsing the ShimCache / AppCompatCache (SYSTEM Hive)
# Tracks executables recently run to ensure OS compatibility. Useful because it survives reboots.
# Path: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
# Result: Discovery of an attacker renaming `powershell.exe` to `svchost.exe` and executing it.

Phase 3: Evidence of Lateral Movement & Network Activity

# Concept: An attacker compromises a workstation and then RDPs to the Domain Controller.
# Even if they delete the Windows Event Logs, the RDP client records the IP addresses and usernames
# connected to permanently inside the specific User's Registry (NTUSER.DAT).

# 1. Analyzing RDP Connections (NTUSER.DAT)
# Path: Software\Microsoft\Terminal Server Client\Default
# Result: Lists the IP address `10.1.5.55` and `MRU0` (Most Recently Used).
# Path: Software\Microsoft\Terminal Server Client\Servers\<IP_Address>
# Result: Lists the `UsernameHint` (e.g., `Administrator` or `SVC_Account`), proving exactly WHICH 
# hijacked account they used to leapfrog to the server.

# 2. Analyzing Mapped Network Drives (NTUSER.DAT)
# Path: Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
# Result: Shows the attacker mapping the `\\Finance-Server\C$` administrative share locally to their `Z:` drive to exfiltrate data.

Phase 4: Proving Persistence Mechanisms (RunKeys)

# Concept: Malware must survive a reboot. It writes an entry telling Windows "Every time you boot, run me."

# 1. Analyzing Standard Run / RunOnce Keys (SOFTWARE and NTUSER.DAT)
# System-wide (Affecting all users): SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# User-specific: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
# Result: Discovered an entry named `Windows_Updater` pointing to `C:\ProgramData\svchost.exe`.

# 2. Obscure Persistence (SYSTEM Hive Services)
# Path: SYSTEM\CurrentControlSet\Services
# Attackers create hidden malicious Services executing DLLs. Analyze the `ImagePath` and `ErrorControl` values 
# to determine if the payload boots via ServiceHost.

Decision Point 🔀

flowchart TD
    A[Acquire Locked Registry Hives] --> B{What is the analytical goal?}
    B -->|Prove Execution| C[Parse Amcache.hve & ShimCache in SYSTEM]
    B -->|Find Persistance| D[Parse Run Keys in NTUSER.DAT & SOFTWARE, Services in SYSTEM]
    B -->|Track User Actions| E[Parse UserAssist & TypedURLs in NTUSER.DAT]
    C --> F[Recover SHA1 Hashes & Compile Timestamps of deleted malware]
    D --> G[Identify malicious DLLs or PowerShell loaders launching quietly at boot]
    E --> H[Prove attacker accessed specific confidential PDF files or directories (`RecentDocs`)]
    F --> I[Upload Hash to VirusTotal / Write YARA Rule for sweeping network]

🔵 Blue Team Detection & Defense

• Automated Artifact Parsing: Traditional IT departments respond to an incident by imaging an entire 1TB hard drive over the network (taking 24 hours). Elite IR teams deploy KAPE or Velociraptor rapidly across thousands of endpoints to target and extract only the Registry Hives and Event Logs (averaging 50MB) returning forensic data and execution evidence across the organization in seconds.
• Sysmon Integration: The registry is deeply complex. Deploy Microsoft Sysmon (System Monitor) prioritizing Event ID 12, 13, and 14 (Registry Object Creation, Modification, and Deletion) specifically monitoring paths like \CurrentVersion\Run or \Services\. Sysmon converts obscure Registry hex modifications into easily parsable JSON strings instantly injected into the SIEM.
• Limit Administrator Execution: The vast majority of deeply ingrained attacker persistence requires modifying the SYSTEM or SOFTWARE hives. Implementing Endpoint Privilege Management (EPM), heavily restricting standard users from attaining Local Administrator privileges, forces attackers to on NTUSER.DAT persistence, simplifying the triage process identically.

Key Concepts

Output Format

Forensics Triage Brief: Incident #899 - Ransomware Precursor Activity
=====================================================================
Target Endpoint: `FIN-WORKSTATION-02`
Artifact Evaluated: `Amcache.hve`, `NTUSER.DAT`, `SYSTEM`

Description:
Digital forensics triage was initiated on `FIN-WORKSTATION-02` following a suspicious Antivirus flag. The endpoint's primary Registry hives were extracted utilizing KAPE for offline parsing utilizing Registry Explorer.

Analysis of the `Amcache.hve` immediately confirmed the execution of a deleted binary located at `C:\Users\Public\svchost.exe` occurring at `2024-03-24 07:12:44Z`. The recovered SHA-1 hash (`8A2B...`) corresponded directly with the Cobalt Strike executable beacon platform. 

Reviewing the `NTUSER.DAT` hive for the compromised user account mapped lateral movement activities; specifically, the Terminal Server Client subkeys indicated a successful Remote Desktop Protocol (RDP) authentication utilizing the `Admin` account pivoting toward the Domain Controller (`10.0.0.5`) exactly 18 minutes post-initial execution.

Conclusion:
The attacker established initial access via a disguised payload, circumvented local protections, and definitively pivoted to core infrastructure. Immediate containment of the Domain Controller and wide-scale password resets are required. 

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• SANS Institute: Windows Registry Forensics Cheat Sheet
• Eric Zimmerman Tools: Registry Explorer/RECmd
• Harlan Carvey: Windows Registry Forensics Book