Procedure examples

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.

TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.

DUSTTRAP can enumerate Registry items.

PUBLOAD has queried Registry values to identify software using `reg query`.

Woody RAT can search registry keys to identify antivirus programs on an compromised host.

Mafalda can enumerate Registry keys with all subkeys and values.

A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.

WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.

InvisiMole can enumerate Registry values, keys, and data.

Volgmer checks the system for certain Registry keys.

TRANSLATEXT has queried the following registry key to check for installed Chrome extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist `.

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.

Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.

DarkWatchman can query the Registry to determine if it has already been installed on the system.

PlugX can enumerate and query for information contained within the Windows Registry.

Reaver queries the Registry to determine the correct Startup path to use for persistence.

Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.

Epic uses the rem reg query command to obtain values from Registry keys.

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.

Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.

Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.

Saint Bot has used `check_registry_keys` as part of its environmental checks.

CharmPower has the ability to enumerate `Uninstall` registry values.

Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.

QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.

BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.

Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.

gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.

Shamoon queries several Registry keys to identify hard disk partitions to overwrite.

RedLine Stealer can query the Windows Registry.

StoneDrill has looked in the registry to find the default browser path.

Attor has opened the registry and performed query searches.

LitePower can query the Registry for keys added to execute COM hijacking.

QUIETCANARY has the ability to retrieve information from the Registry.

Derusbi is capable of enumerating Registry keys and values.

BlackByte Ransomware enumerates the Registry, specifically the `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` key.

SodaMaster has the ability to query the Registry to detect a key specific to VMware.

LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.

Sibot has queried the registry for proxy server information.

ZxxZ can search the registry of a compromised host.

WINDSHIELD can gather Registry values.

Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Bazar can query Windows\CurrentVersion\Uninstall for installed applications.

RATANKBA uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.

Kapeka queries registry values for stored configuration information.

Zebrocy executes the reg query command to obtain information in the Registry.

FinFisher queries Registry values as part of its anti-sandbox checks.