Procedure examples

SynAck enumerates Registry keys associated with event logs.

Bumblebee can check the Registry for specific keys.

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.

Stuxnet searches the Registry for indicators of security programs.

POWRUNER may query the Registry by running reg query on a victim.

Ursnif has used Reg to query the Registry for installed programs.

POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.

Zeus Panda checks for the existence of a Registry key and if it contains certain values.

Bankshot searches for certain Registry keys to be configured before executing the payload.

Brave Prince gathers information about the Registry.

TinyTurla can query the Registry for its configuration information.

Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.

TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.

DUSTTRAP can enumerate Registry items.

PUBLOAD has queried Registry values to identify software using `reg query`.

Woody RAT can search registry keys to identify antivirus programs on an compromised host.

Mafalda can enumerate Registry keys with all subkeys and values.

A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.

WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.

InvisiMole can enumerate Registry values, keys, and data.

Volgmer checks the system for certain Registry keys.

TRANSLATEXT has queried the following registry key to check for installed Chrome extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist `.

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.

Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.

DarkWatchman can query the Registry to determine if it has already been installed on the system.

PlugX can enumerate and query for information contained within the Windows Registry.

Reaver queries the Registry to determine the correct Startup path to use for persistence.

Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.

Epic uses the rem reg query command to obtain values from Registry keys.

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.

Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.

Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.

Saint Bot has used `check_registry_keys` as part of its environmental checks.

CharmPower has the ability to enumerate `Uninstall` registry values.

Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.

QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.

BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.

Uroburos can query the Registry, typically `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds`, to find the key and path to decrypt and load its kernel driver and kernel driver loader.

gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.

Shamoon queries several Registry keys to identify hard disk partitions to overwrite.

RedLine Stealer can query the Windows Registry.

StoneDrill has looked in the registry to find the default browser path.

Attor has opened the registry and performed query searches.

LitePower can query the Registry for keys added to execute COM hijacking.

QUIETCANARY has the ability to retrieve information from the Registry.

Derusbi is capable of enumerating Registry keys and values.

BlackByte Ransomware enumerates the Registry, specifically the `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` key.