Procedure examples

SodaMaster has the ability to query the Registry to detect a key specific to VMware.

LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.

Sibot has queried the registry for proxy server information.

ZxxZ can search the registry of a compromised host.

WINDSHIELD can gather Registry values.

Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Bazar can query Windows\CurrentVersion\Uninstall for installed applications.

RATANKBA uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.

Kapeka queries registry values for stored configuration information.

Zebrocy executes the reg query command to obtain information in the Registry.

FinFisher queries Registry values as part of its anti-sandbox checks.

Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

REvil can query the Registry to get random file extensions to append to encrypted files.

Valak can use the Registry for code updates and to collect credentials.

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.

Carbon enumerates values in the Registry.

Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.

FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.

ZxShell can query the netsvc group value data located in the svchost group Registry key.

BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.

njRAT can read specific registry values.

ComRAT can check the default browser by querying HKCR\http\shell\open\command.

JPIN can enumerate Registry keys.

Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

DownPaper searches and reads the value of the Windows Update Registry Run key.

Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Denis queries the Registry for keys and values.

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.

OSInfo queries the registry to look for information about Terminal Services.

Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.

Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

ADVSTORESHELL can enumerate registry keys.

SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.

PcShare can search the registry files of a compromised host.

Remcos can obtain Registry data from targeted systems.

Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.