Analyzing Windows Registry for Artifacts

分析Windows注册表取证痕迹

When to Use

适用场景

When investigating user activity on a Windows system during an incident
For identifying autorun/persistence mechanisms used by malware
When tracing installed software, USB devices, and network connections
During insider threat investigations to reconstruct user actions
For correlating registry timestamps with other forensic artifacts

事件调查期间分析Windows系统上的用户活动
识别恶意软件使用的自启动/持久化机制
追踪已安装软件、USB设备和网络连接
内部威胁调查中重建用户操作
将注册表时间戳与其他取证痕迹关联分析

Prerequisites

前置条件

Forensic image or extracted registry hive files
RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
Understanding of Windows Registry structure (hives, keys, values)
SIFT Workstation or forensic analysis environment

取证镜像或提取的注册表配置单元文件
RegRipper、Registry Explorer（Eric Zimmerman）或python-registry
能够访问注册表配置单元存储位置（SAM、SYSTEM、SOFTWARE、NTUSER.DAT、UsrClass.dat）
了解Windows注册表结构（配置单元、键、值）
SIFT Workstation或取证分析环境

Workflow

工作流程

Step 1: Extract Registry Hives from the Forensic Image

步骤1：从取证镜像中提取注册表配置单元

bash

undefined

bash

undefined

Mount the forensic image read-only

mkdir /mnt/evidence mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence

Copy system registry hives

cp /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/

Copy user-specific hives

cp /mnt/evidence/Users//NTUSER.DAT /cases/case-2024-001/registry/ cp /mnt/evidence/Users//AppData/Local/Microsoft/Windows/UsrClass.dat /cases/case-2024-001/registry/

Copy transaction logs (for dirty hive recovery)

cp /mnt/evidence/Windows/System32/config/.LOG /cases/case-2024-001/registry/logs/

Hash all extracted hives

sha256sum /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt

undefined

sha256sum /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt

undefined

Step 2: Analyze with RegRipper for Automated Artifact Extraction

步骤2：使用RegRipper自动提取取证痕迹

bash

undefined

bash

undefined

Install RegRipper

git clone https://github.com/keydet89/RegRipper3.0.git /opt/regripper

Run RegRipper against NTUSER.DAT (user profile)

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-f ntuser > /cases/case-2024-001/analysis/ntuser_report.txt

Run against SYSTEM hive

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-f system > /cases/case-2024-001/analysis/system_report.txt

Run against SOFTWARE hive

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE
-f software > /cases/case-2024-001/analysis/software_report.txt

Run against SAM hive (user accounts)

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SAM
-f sam > /cases/case-2024-001/analysis/sam_report.txt

Run specific plugins

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p userassist > /cases/case-2024-001/analysis/userassist.txt

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p usbstor > /cases/case-2024-001/analysis/usbstor.txt

undefined

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p userassist > /cases/case-2024-001/analysis/userassist.txt

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p usbstor > /cases/case-2024-001/analysis/usbstor.txt

undefined

Step 3: Extract Persistence and Autorun Entries

步骤3：提取持久化与自启动条目

bash

undefined

bash

undefined

Using python-registry for targeted extraction

pip install python-registry

python3 << 'PYEOF' from Registry import Registry

pip install python-registry

python3 << 'PYEOF' from Registry import Registry

Open SOFTWARE hive

reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE")

Check Run keys (autostart)

autorun_paths = [ "Microsoft\Windows\CurrentVersion\Run", "Microsoft\Windows\CurrentVersion\RunOnce", "Microsoft\Windows\CurrentVersion\RunServices", "Microsoft\Windows\CurrentVersion\Policies\Explorer\Run", "Wow6432Node\Microsoft\Windows\CurrentVersion\Run" ]

for path in autorun_paths: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass

autorun_paths = [ "Microsoft\Windows\CurrentVersion\Run", "Microsoft\Windows\CurrentVersion\RunOnce", "Microsoft\Windows\CurrentVersion\RunServices", "Microsoft\Windows\CurrentVersion\Policies\Explorer\Run", "Wow6432Node\Microsoft\Windows\CurrentVersion\Run" ]

for path in autorun_paths: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass

Check installed services

key = reg.open("Microsoft\Windows NT\CurrentVersion\Svchost") print(f"\n=== Svchost Groups ===") for value in key.values(): print(f" {value.name()}: {value.value()}") PYEOF

Check NTUSER.DAT for user-specific autorun

python3 << 'PYEOF' from Registry import Registry

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

user_autorun = [ "Software\Microsoft\Windows\CurrentVersion\Run", "Software\Microsoft\Windows\CurrentVersion\RunOnce", "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" ]

for path in user_autorun: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass PYEOF

undefined

python3 << 'PYEOF' from Registry import Registry

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

user_autorun = [ "Software\Microsoft\Windows\CurrentVersion\Run", "Software\Microsoft\Windows\CurrentVersion\RunOnce", "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" ]

for path in user_autorun: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass PYEOF

undefined

Step 4: Analyze User Activity Artifacts

步骤4：分析用户活动取证痕迹

bash

undefined

bash

undefined

Extract UserAssist data (program execution history with ROT13 encoding)

python3 << 'PYEOF' from Registry import Registry import codecs, struct, datetime

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

ua_path = "Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" key = reg.open(ua_path)

for guid_key in key.subkeys(): count_key = guid_key.subkey("Count") print(f"\n=== {guid_key.name()} ===") for value in count_key.values(): decoded_name = codecs.decode(value.name(), 'rot_13') data = value.value() if len(data) >= 16: run_count = struct.unpack('<I', data[4:8])[0] focus_count = struct.unpack('<I', data[8:12])[0] timestamp = struct.unpack('<Q', data[60:68])[0] if len(data) >= 68 else 0 if timestamp > 0: ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10) print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}") else: print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}") PYEOF

python3 << 'PYEOF' from Registry import Registry import codecs, struct, datetime

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

ua_path = "Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" key = reg.open(ua_path)

for guid_key in key.subkeys(): count_key = guid_key.subkey("Count") print(f"\n=== {guid_key.name()} ===") for value in count_key.values(): decoded_name = codecs.decode(value.name(), 'rot_13') data = value.value() if len(data) >= 16: run_count = struct.unpack('<I', data[4:8])[0] focus_count = struct.unpack('<I', data[8:12])[0] timestamp = struct.unpack('<Q', data[60:68])[0] if len(data) >= 68 else 0 if timestamp > 0: ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10) print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}") else: print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}") PYEOF

Extract Recent Documents (MRU lists)

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p recentdocs > /cases/case-2024-001/analysis/recentdocs.txt

Extract typed URLs (browser)

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p typedurls > /cases/case-2024-001/analysis/typedurls.txt

Extract typed paths in Explorer

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt

undefined

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT
-p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt

undefined

Step 5: Extract System and Network Information

步骤5：提取系统与网络信息

bash

undefined

bash

undefined

Computer name and OS version from SYSTEM hive

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p compname > /cases/case-2024-001/analysis/system_info.txt

Network interfaces and configuration

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p nic2 >> /cases/case-2024-001/analysis/system_info.txt

Wireless network history

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE
-p networklist > /cases/case-2024-001/analysis/network_history.txt

Timezone configuration

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p timezone > /cases/case-2024-001/analysis/timezone.txt

Shutdown time

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM
-p shutdown > /cases/case-2024-001/analysis/shutdown.txt

Installed software from Uninstall keys

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE
-p uninstall > /cases/case-2024-001/analysis/installed_software.txt

undefined

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE
-p uninstall > /cases/case-2024-001/analysis/installed_software.txt

undefined

Key Concepts

核心概念

Concept	Description
Registry hive	Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT)
MRU (Most Recently Used)	Lists tracking recently accessed files, commands, and search terms
UserAssist	ROT13-encoded registry entries tracking program execution with timestamps
ShimCache	Application compatibility cache recording executed programs
AmCache	Detailed execution history including SHA-1 hashes of executables
BAM/DAM	Background/Desktop Activity Moderator tracking program execution in Win10+
Last Write Time	Timestamp on registry keys indicating when they were last modified
Transaction logs	Journal files allowing recovery of registry state after improper shutdown

概念	描述
Registry hive	存储注册表某一部分的二进制文件（SAM、SYSTEM、SOFTWARE、NTUSER.DAT）
MRU（Most Recently Used）	追踪最近访问的文件、命令和搜索词的列表
UserAssist	采用ROT13编码的注册表条目，记录程序执行情况及时间戳
ShimCache	应用兼容性缓存，记录已执行的程序
AmCache	详细的执行历史，包含可执行文件的SHA-1哈希值
BAM/DAM	Background/Desktop Activity Moderator，在Win10及以上系统中追踪程序执行情况
Last Write Time	注册表键上的时间戳，指示其最后修改时间
Transaction logs	日志文件，可在非正常关机后恢复注册表状态

Tools & Systems

工具与系统

Tool	Purpose
RegRipper	Automated registry artifact extraction with plugin architecture
Registry Explorer	Eric Zimmerman GUI tool for interactive registry analysis
python-registry	Python library for programmatic registry hive parsing
RECmd	Eric Zimmerman command-line registry analysis tool
yarp	Yet Another Registry Parser for Python-based analysis
AppCompatCacheParser	Dedicated ShimCache/AppCompatCache parser
AmcacheParser	Dedicated AmCache.hve analysis tool
ShellBags Explorer	Specialized tool for analyzing ShellBag artifacts

工具	用途
RegRipper	带有插件架构的自动化注册表取证痕迹提取工具
Registry Explorer	Eric Zimmerman开发的GUI工具，用于交互式注册表分析
python-registry	用于程序化解析注册表配置单元的Python库
RECmd	Eric Zimmerman开发的命令行注册表分析工具
yarp	Yet Another Registry Parser，基于Python的注册表分析工具
AppCompatCacheParser	专用的ShimCache/AppCompatCache解析工具
AmcacheParser	专用的AmCache.hve分析工具
ShellBags Explorer	用于分析ShellBag取证痕迹的专业工具

Common Scenarios

常见场景

Scenario 1: Malware Persistence Investigation Extract SOFTWARE and NTUSER.DAT hives, check all Run/RunOnce keys for unauthorized entries, examine services for suspicious additions, check scheduled tasks registry keys, correlate autorun timestamps with malware execution timeline.

Scenario 2: User Activity Reconstruction Analyze UserAssist for program execution history, examine RecentDocs for accessed files, check TypedPaths for Explorer navigation, extract ShellBags for folder access patterns, build a timeline of user activity around the incident window.

Scenario 3: Unauthorized Software Detection Parse Uninstall keys for all installed applications, compare against approved software baseline, check BAM/DAM for recently executed programs not in approved list, examine AppCompatCache for execution evidence even after uninstallation.

Scenario 4: USB Data Exfiltration Investigation Extract USBSTOR entries from SYSTEM hive for connected devices, correlate device serial numbers with MountedDevices, check NTUSER.DAT MountPoints2 for user access to removable media, examine SetupAPI logs for first-connection timestamps.

场景1：恶意软件持久化调查 提取SOFTWARE和NTUSER.DAT配置单元，检查所有Run/RunOnce键是否存在未授权条目，检查服务是否有可疑新增项，查看计划任务注册表键，将自启动时间戳与恶意软件执行时间线关联分析。

场景2：用户活动重建 分析UserAssist获取程序执行历史，查看RecentDocs了解访问过的文件，检查TypedPaths获取资源管理器导航记录，提取ShellBags分析文件夹访问模式，构建事件窗口内的用户活动时间线。

场景3：未授权软件检测 解析Uninstall键获取所有已安装应用，与批准的软件基线对比，检查BAM/DAM查找最近执行的未在批准列表中的程序，查看AppCompatCache获取软件卸载后的执行证据。

场景4：USB数据泄露调查 从SYSTEM配置单元提取USBSTOR条目获取连接过的设备，将设备序列号与MountedDevices关联，检查NTUSER.DAT的MountPoints2获取用户对可移动媒体的访问记录，查看SetupAPI日志获取首次连接时间戳。

Output Format

输出格式

Registry Analysis Summary:
  System: DESKTOP-ABC123 (Windows 10 Pro Build 19041)
  Timezone: Eastern Standard Time (UTC-5)
  Last Shutdown: 2024-01-18 23:45:12 UTC

  Autorun Entries:
    HKLM Run:     5 entries (1 suspicious: "updater.exe" -> C:\ProgramData\svc\updater.exe)
    HKCU Run:     3 entries (all legitimate)
    Services:     142 entries (2 unknown: "WinDefSvc", "SysMonAgent")

  User Activity (NTUSER.DAT):
    UserAssist Programs:  234 entries
    Recent Documents:     89 entries
    Typed URLs:           45 entries
    Typed Paths:          12 entries

  USB Devices Connected:
    - Kingston DataTraveler (Serial: 0019E06B4521) - First: 2024-01-10, Last: 2024-01-18
    - WD My Passport (Serial: 575834314131) - First: 2024-01-15, Last: 2024-01-15

  Installed Software:     127 applications
  Suspicious Findings:    3 items flagged for review

注册表分析摘要:
  系统: DESKTOP-ABC123 (Windows 10 Pro Build 19041)
  时区: 东部标准时间 (UTC-5)
  最后关机时间: 2024-01-18 23:45:12 UTC

  自启动条目:
    HKLM Run:     5个条目（1个可疑: "updater.exe" -> C:\ProgramData\svc\updater.exe）
    HKCU Run:     3个条目（均合法）
    服务:     142个条目（2个未知: "WinDefSvc", "SysMonAgent"）

  用户活动（NTUSER.DAT）:
    UserAssist程序记录:  234条
    最近访问文档:     89条
    已输入URL:           45条
    已输入路径:          12条

  已连接USB设备:
    - Kingston DataTraveler（序列号: 0019E06B4521）- 首次连接: 2024-01-10, 最后连接: 2024-01-18
    - WD My Passport（序列号: 575834314131）- 首次连接: 2024-01-15, 最后连接: 2024-01-15

  已安装软件:     127个应用
  可疑发现:    3项需复核

analyzing-windows-registry-for-artifacts

Original

Translation

Analyzing Windows Registry for Artifacts

分析Windows注册表取证痕迹

When to Use

适用场景

Prerequisites

前置条件

Workflow

工作流程

Step 1: Extract Registry Hives from the Forensic Image

步骤1：从取证镜像中提取注册表配置单元

Mount the forensic image read-only

Mount the forensic image read-only

Copy system registry hives

Copy system registry hives

Copy user-specific hives

Copy user-specific hives

Copy transaction logs (for dirty hive recovery)

Copy transaction logs (for dirty hive recovery)

Hash all extracted hives

Hash all extracted hives

Step 2: Analyze with RegRipper for Automated Artifact Extraction

步骤2：使用RegRipper自动提取取证痕迹

Install RegRipper

Install RegRipper

Run RegRipper against NTUSER.DAT (user profile)

Run RegRipper against NTUSER.DAT (user profile)

Run against SYSTEM hive

Run against SYSTEM hive

Run against SOFTWARE hive

Run against SOFTWARE hive

Run against SAM hive (user accounts)

Run against SAM hive (user accounts)

Run specific plugins

Run specific plugins

Step 3: Extract Persistence and Autorun Entries

步骤3：提取持久化与自启动条目

Using python-registry for targeted extraction

Using python-registry for targeted extraction

Open SOFTWARE hive

Open SOFTWARE hive

Check Run keys (autostart)

Check Run keys (autostart)

Check installed services

Check installed services

Check NTUSER.DAT for user-specific autorun

Check NTUSER.DAT for user-specific autorun

Step 4: Analyze User Activity Artifacts

步骤4：分析用户活动取证痕迹

Extract UserAssist data (program execution history with ROT13 encoding)

Extract UserAssist data (program execution history with ROT13 encoding)

Extract Recent Documents (MRU lists)

Extract Recent Documents (MRU lists)

Extract typed URLs (browser)

Extract typed URLs (browser)

Extract typed paths in Explorer

Extract typed paths in Explorer

Step 5: Extract System and Network Information

步骤5：提取系统与网络信息

Computer name and OS version from SYSTEM hive

Computer name and OS version from SYSTEM hive

Network interfaces and configuration

Network interfaces and configuration

Wireless network history

Wireless network history

Timezone configuration

Timezone configuration

Shutdown time

Shutdown time

Installed software from Uninstall keys

Installed software from Uninstall keys

Key Concepts

核心概念

Tools & Systems

工具与系统

Common Scenarios

常见场景

Output Format