Procedure examples

Trojan.Karagany can monitor the titles of open windows to identify specific keywords.

Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

NightClub can use `GetForegroundWindow` to enumerate the active window.

Grandoreiro can identify installed security tools based on window names.

SOUNDBITE is capable of enumerating application windows.

Cadelspy has the ability to identify open windows on the compromised host.

HotCroissant has the ability to list the names of all open windows on the infected host.

PoisonIvy captures window titles.

PLEAD has the ability to list open windows on the compromised host.

FunnyDream has the ability to discover application windows via execution of `EnumWindows`.

NetTraveler reports window names along with keylogger information to provide application context.

njRAT gathers information about opened windows during the initial infection.

Remexi has a command to capture active windows on the machine and retrieve window titles.

QakBot has the ability to enumerate windows on a compromised host.

SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.

Remcos can list all windows on victim systems.

APT-C-36 used a customized version of QuasarRAT to monitor browser windows for strings relating to specific Colombian financial institutions.

The discovery modules used with Duqu can collect information on open windows.

Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.

During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.

Indrik Spider has used a service account to extract copies of the `Security` Registry hive.

BlackByte queried registry values to determine system language settings.

Kimsuky has obtained specific Registry keys and values on a compromised host.

Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.

APT41 queried registry values to determine items such as configured RDP ports and network configurations.

Dragonfly has queried the Registry to identify victim information.

APT32's backdoor can query the Windows Registry to gather system information.

Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses. Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.

ZIRCONIUM has used a tool to query the Registry for proxy settings.

APT39 has used various strains of malware to query the Registry.

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

Lotus Blossom has run commands such as `reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Parameters` to verify if installed implants are running as a service.

Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.

Chimera has queried Registry keys using reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.

A Threat Group-3390 tool can read and decrypt stored Registry values.

SynAck enumerates Registry keys associated with event logs.

Bumblebee can check the Registry for specific keys.

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.

Stuxnet searches the Registry for indicators of security programs.

POWRUNER may query the Registry by running reg query on a victim.

Ursnif has used Reg to query the Registry for installed programs.

POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.

Zeus Panda checks for the existence of a Registry key and if it contains certain values.

Bankshot searches for certain Registry keys to be configured before executing the payload.

Brave Prince gathers information about the Registry.