Registry Flashcards
What is a registry?
A central hierarchical database used in Windows.
How is registry data stored?
5 top level root keys.
What is the HKCU?
HKEY_CURRENT_USER
What does the HKCU contain?
User information and configuration.
What is HKU?
HKEY_USERS
What does the HKU contain?
Contains all actively loaded user profiles.
What is the HKCR?
HKEY_CLASSES_ROOT
What is the HKLM?
HKEY_LOCAL_MACHINE
What is the HKCC?
HKEY_CURRENT_CONFIG
What is contained in the HKCR?
Maps explorer files -> programs.
What is contained in the HKLM?
Computer config for any user.
What is contained in the HKCC?
Hardware profile used at startup.
What are Registry Hives?
How registry is represented on the file system.
Where are the system registry hives?
C:\Windows\System32\Config\
What is contained in the system registry hives?
DEFAULT
SAM
SECURITY
SOFTWARE
SYSTEM
Where are the user registry hives?
C:\Users<username>\NTUSER.dat
and
C:\Users<username>\AppData\Local\Microsoft\Windows\UsrClass.dat
DEFAULT hive
Template for new user hives.
SAM
Store windows user passwords
SECURITY
Info about the domain that the machine is attached to.
SOFTWARE
Software and Windows settings. Good place to check for Malware.
SYSTEM
System config. Currently mounted drives.
NTUSER.dat
User settings. Program execution or file/folder usage.
UsrClass.dat
More NTUSER stuff.
LOG1/LOG2
Rewind logs.
What are the differences between hives and top level keys?
Keys are data inside of the hives. Hives are how registries are represented on the file system.
What is the most valuable registry key?
HKEY_LOCAL_MACHINE
What is an ASEP?
Autostart extension points.
What is contained in ASEPs?
What to start on the computer at bootup?
What is Run vs RunOnce?
Run runs every time the user logs on. RunOnce runs one time, then is deleted.
What is the difference between targets and modules in KAPE?
Targets - Collection points
Modules - what to do with the data.
Where is OS Version stored?
SOFTWARE\MicrosoftWindows NT\CurrentVersion
Where are autostart programs stored?
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion(Run/RunOnce)
or
SOFTWARE\Microsoft\Windows\CurrentVersion(Run/RunOnce)
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Where are SAM/User information?
SAM\Domains\Account\Users
Recent files?
NTUSER.DAT\Software\Microsoft\Windows
\CurrentVersion\Explorer\RecentDocs
Address/Search Bars location?
NTUSER.DAT (TypedPaths/WordWheelQuery)
External USB/Device identification?
USBSTOR or USB
USB First/Last Times
USBSerial\Properties
Evidence of Execution
NTUSER.DAT\Software...\UserAssist{GUID}\Count
What two root keys are most valuable?
HKLM and HKCU
What tool can build a clean hive from dirty hive?
Registry Explorer
Where are RunOnce ASEPs held?
HKCU and HKLM in CurrentVersion\RunOnce
