> For the complete documentation index, see [llms.txt](https://fareedfauzi.gitbook.io/ctf-training/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fareedfauzi.gitbook.io/ctf-training/forensic/kape-triage/registry-analysis.md).

# Registry Analysis

## What is registry

Registry is a hierarchical database that serves as a central repository for 

1. Configuration settings
2. Information about the software, hardware, and user preferences

In perspective of attacker, registry can be abuse to:

* Setup persistence
* Modify config such as WDigest
* Disable WinDefender
* Privilege Escalation
* User Account Manipulation
* And many more (<https://redteamrecipe.com/Registry-Attack-Vectors/>)

## &#x20;Registry hives explained

| Registry hives        | Description                                                                                      |
| --------------------- | ------------------------------------------------------------------------------------------------ |
| HKEY\_CLASSES\_ROOT   | A symbolic link to HKLM\SOFTWARE\Classes                                                         |
| HKEY\_CURRENT\_USER   | A symbolic link to the part of HKEY\_USERS representing the currently logged in user's profile.  |
| HKEY\_LOCAL\_MACHINE  | Contains information about all the installed hardware and software.                              |
| HKEY\_USERS           | Contains preferences for each of the user profiles on the machine                                |
| HKEY\_CURRENT\_CONFIG | Symbolic link that points to the part in HKLM that applies to the current hardware configuration |

## Registry structure

<figure><img src="https://lh7-us.googleusercontent.com/UVYC-adHpD7uhe9v2FUiS7ioBAbPTRA2rll2ZBFLvEqXCOvMw3jpCPMiXHgpsBZmcfZ39WYyiWNYGlnAnQwF4yBAuPhx_OdBp0SbbpUJLJc3l9uJAFT-dAECzg6VzEU6oXRbKu4jmnjTnPSAB3TzXvRfAA=s2048" alt=""><figcaption></figcaption></figure>

## Registry artifact location

| System registry                                                                              | Current user registry                                                                                                                      |
| -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| <ul><li>%WinDir%\System32\Config\*</li><li>%WinDir%\appcompat\Programs\AMCACHE.hve</li></ul> | <p></p><ul><li>C:\Users\&#x3C;username>\NTUSER.dat</li><li>C:\Users\&#x3C;username>\AppData\Local\Microsoft\Windows\USRCLASS.DAT</li></ul> |

## Using Registry Explorer

<figure><img src="https://665104163-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrgnT6YaXl0rwqp4CAxuD%2Fuploads%2F7BjlTlprqT4dNxNEBTlK%2Fimage.png?alt=media&amp;token=46837235-2eb5-41be-a6dd-ba9552c507a9" alt=""><figcaption></figcaption></figure>

Please refer:  <https://fareedfauzi.github.io/2023/12/22/Windows-Forensics-checklist-cheatsheet.html#triage-artifacts-parsing-and-analysis>