Forensia CTI Core

About

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Platforms: WindowsMITRE ATT&CK ↗

Used by actors

19 known groups

G0010 Turla G0027 Threat Group-3390 G0030 Lotus Blossom G0032 Lazarus Group G0035 Dragonfly G0038 Stealth Falcon G0047 Gamaredon Group G0049 OilRig G0050 APT32 G0087 APT39 G0094 Kimsuky G0096 APT41 G0114 Chimera G0117 Fox Kitten G0119 Indrik Spider G0128 ZIRCONIUM G1017 Volt Typhoon G1034 Daggerfly G1043 BlackByte

Software

99 malware/tools implement this

TaidoorPlugXDerusbiUroburosCHOPSTICKCarbanakBACKSPACEgh0st RATADVSTORESHELLRegEpicCrimsonComRATShamoonPOWERSOURCECobalt StrikeWINDSHIELDOSInfoReaverVolgmerFinFisherPOWRUNERDownPaperPowerSploitJPINHydraqProxysvcBankshotROKRATRATANKBASynAckGold DragonZebrocyBrave PrinceInvisiMoleFELIXROOTBisonalQUADAGENTZeus PandaRemcosCarbonAzorultCardinal RATDenisHOPLIGHTStoneDrillnjRATUrsnifZxShellBabySharkAttorRising SunValakCarberpREvilFatDukeLiteDukePillowmintLuciferBazarSUNBURSTTEARDROPDtrackBitPaymerBendyBearWaterbearSibotStuxnetIndustroyerWastedLockerSodaMasterClamblingGelsemiumTinyTurlaDarkWatchmanCharmPowerLitePowerSILENTTRINITYZxxZMilanSaint BotSharkBumblebeeFunnyDreamMoriPcShareMafaldaSVCReadyWoody RATQUIETCANARYSamuraiRaccoon StealerDUSTTRAPBlackByte RansomwareKapekaTRANSLATEXTPUBLOADRedLine StealerQilin

Corpus indicators tagged with this technique

204 indicators in the corpus carry T1012.

Indicator	Type	Family	Sev	Src
cve-2021-27076	cve	—	85	1
848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2	sha256	—	80	1
7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8	sha256	—	80	1
2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86	sha256	—	80	1
4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47	sha256	—	80	1
8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5	sha256	—	80	1
12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c	sha256	—	80	1
d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e	sha256	—	80	1
19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4	sha256	—	80	1
1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea	sha256	—	80	1
307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1	sha256	—	80	1
3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0	sha256	—	80	1
5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1	sha256	—	80	1
7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9	sha256	—	80	1
2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d	sha256	—	80	1
ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736	sha256	—	80	1
a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450	sha256	—	80	1
5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089	sha256	—	80	1
f1c3ebe78bd8c38559bf3cfcc9a9fa37d221e31780774a3787e26160a61f5348	hash	—	80	3
ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9	sha256	—	80	1
1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21	sha256	—	80	1
1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d	sha256	—	80	1
2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee	sha256	—	80	1
66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8	sha256	—	80	1
a2c6e01001c62f6198e31a9d603977c6	hash	—	80	2
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31	sha256	—	80	1
512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2	sha256	—	80	1
57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6	sha256	—	80	1
85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3	sha256	—	80	1

Showing the top 30 by severity of 204.