Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.1 Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
- Wikipedia Windows Registry
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1034 | Daggerfly | — |
| grp_g1043 | BlackByte | — |
| grp_g0038 | Stealth Falcon | — |
| grp_g0117 | Fox Kitten | — |
| grp_g0128 | ZIRCONIUM | — |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0119 | Indrik Spider | Russia |
| grp_g0114 | Chimera | China |
| grp_g0035 | Dragonfly | Russia |
| grp_g0049 | OilRig | Iran |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0087 | APT39 | — |
| grp_g0010 | Turla | Russia |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0030 | Lotus Blossom | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0096 | APT41 | China |
| grp_g0027 | Threat Group-3390 | China |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.