Windows Registry Challenge — LetsDefend
Hello Everyone! I am going to do a step-by-step guide on analyzing a Windows Registry file and answering some challenge questions. We shall start by opening Registry Explorer and running the application with administrative rights. From there, we will load each of the needed hives for the investigation and their associated transaction logs. The correct hives will be listed in the picture below:
You can accomplish loading these hives by clicking File -> Load Offline Hive and following the registry path in the C drive for each of the hives listed above. The first question that is asked for the challenge is how many users were added. We can figure this out by following the given registry path and subtracting the default accounts from the list: HKLM\SAM\SAM\Domains\Account\Users\. This key gives us information about different user accounts, groups, login information, password policy, and more. Here we can see there are 6 accounts total, minus the four default accounts, giving us two added accounts.
Our next question asks us what’s the build number of the operating system of the compromised station. To figure that out, we must go to the following path: SOFTWARE\Microsoft\Windows NT\CurrentVersion. This gives us information about the operating system in question.
The challenge then requests the IP address of the machine being investigated. To find the IP address, we go to the following key: SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6d92100e-8673–4a36–8636–6071ff6637ad}. This key gives us TCP/IP configuration information.
Next, we are tasked with finding a game that has been suspected to be downloaded onto the system. To figure this out as quickly as possible, we should open Shellbag Explorer and load the usrclass.dat hive. Shellbags can help us identify user activity and user interaction with the shell. After briefly browsing Shellbag Explorer, I found something suspicious that is most likely the game in question:
Not only that, but I see a document in the Downloads folder that may be of interest. We are then tasked with determining when a file was executed from the downloads directory. Shimcache gives us a record about executable files on a system. To figure out information on the executables, we must run the AppCompatCacheParser.exe tool as such:
Then explore the CSV file with Timeline Explorer. Type in Downloads from the search bar to see which files are under the Downloads path, and we only get one result and Timeline Explorer indicates it was executed.
Get Dh’s stories in your inbox
Join Medium for free to get updates from this writer.
We also suspect that a user may have installed a malicious file on the computer and we are in charge of getting the sha1 hash of the associated file. We saw that there was a file named “DeathNote” that was installed onto the computer from an earlier question. To get the hash of that file, we will next need to use Amcache Parser to parse the Amcache hive. This hive gives us a plethora of information such as hash values of files and other information about applications and programs that were executed.
Once parsed, we will once again use Timeline Explorer to open the “20260727014641_Amcache_UnassociatedFileEntries.csv” and search for the DeathNote file.
Next, we need to figure out what family this malware belongs to. To do this, we plug the hash value into VirusTotal and look at the Family Labels:
jaik is the correct answer. We now need to know when the user opened a file during a specific time. The time that the file was opened was 2024–05–06 06:39:09. To figure out what possible documents were opened and when, we need to travel to the “NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs” key in RegistryExplorer. Once there, we need to look for a file that was opened at that time. When hovering over the “Opened On” tab for note.txt, we get a match for the exact time:
If we travel down to the “RunMRU” subkey within the RecentDocs key, we can get the answer to the next question, which is when MSPaint was opened on the system.
The last question is how long the user had MSPaint open. To figure that out, we need to go to this registry key: NTUSER.DATSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist with RegistryExplorer and look for the MSPaint entry.
With that last question out of the way, we have finally completed the challenge!
