Registry file forensics basics

 using autopsy (windows tool), registryexplorer.exe (windows tool), regshell (linux tool) we can investigate registry file and find out malware persistency. 

using autopsy --> type of data source would be Logical Files. 

you can run strings command first to catch the flag:

strings -n 10 query | grep -i HTB  (query is registry hive file) 

if you see some registry values are encrypted then you can use rot13 tool or other cryptography tool to decode those using cyber chef. 

using regshell tool:

apt-get install registry-tools 

regshell --help

regshell -F query   (query is the registry file that we are investigating)

you will get some options like info, list etc (similar like directory). click on list

\> list

Now go to Software>Microsoft>Windows>CurrentVersion> Now go to either Run or RunOnce, RunServices and RunServicesOnce directory to see is there any suspicious executables hiding there or not. 

 

regripper:

apt-cache search regripper 

apt install regripper (on kali) 

 Hive file is SAM that we downloaded.

Report file is > click on browse > type report.....it will be shown as report.txt

plugin file is sam in this case. Then click on Rip it. Then check report.txt file.