Search
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
3 min read

Windows Forensics: How I Traced Suspicious Activity Using Registry Hives

Raúl Vázquez González's Picture
Raúl Vázquez González in ez-tools digital-forensics windows-forensics dfir

Windows Forensics: How I Traced Suspicious Activity Using Registry Hives

Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts

Note: This article contains spoilers for the Windows Forensics Challenge. If you haven’t completed the room yet, proceed with caution!

The Scenario

The objective of this investigation is to analyze suspicious activity detected on a research lab computer.
 Here’s what was known:

  • Typically, each computer has only one account ,  but one machine contained several.
  • The system was suspected of connecting to a network drive.
  • A USB device may have been connected to it.

I received a triage collection captured via KAPE, maintaining the same directory structure as the original system.
 To analyze the data, I used Eric Zimmerman’s Registry Explorer.

The main goal was to locate the relevant registry hives, extract the necessary information, and identify digital artifacts that could confirm or disprove the suspicions.

Tip:_ When loading registry hives in Registry Explorer, you’ll see a “dirty hives” warning.
 Follow the command prompt instructions to update them using both .LOG1 and .LOG2 files.
 Save the new file, reload it, and reject the “dirty” version — this ensures you’re working with a fully functional hive._

The Investigation

Questions 1, 2, and 3

Questions:

  1. How many user-created accounts are present on the system?
  2. What is the username of the account that has never logged in?
  3. What’s the password hint for the user THM-4n6?

To answer these, I loaded the SAM hive, which stores:

  • User account information
  • Login data
  • Group memberships

Hive Location:
 C:\Windows\System32\Config\SAM

Relevant Key Path:
 SAM\Domains\Account\Users

1_SYeGlyPoHqZIgR_D0XcyEg.png

Findings:

  • Answer 1: 3
  • Answer 2: thm-user2
  • Answer 3: count

Question 4

Question:
 When was the file Changelog.txt last accessed?

This required identifying file access information. Such details are stored in the NTUSER.DAT hive for each user.

Hive Location:
 C:\Users\<username>\NTUSER.DAT

Relevant Key Path:
 Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

I examined each user’s hive until I found the one listing the file. The user THM-4n6 contained the evidence I needed.

1_rjLRfov_JxfsZ-2SvLRdFQ.png

Answer 4: 2021–11–24 18:18:48

Question 5

Question:
 What is the complete path from where the Python 3.8.2 installer was run?

This artifact indicates evidence of execution. Again, I analyzed NTUSER.DAT under the THM-4n6 profile.

Hive Location:
 C:\Users\THM-4n6\NTUSER.DAT

Relevant Key Path:
 Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

Within the GUID {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}, I found the entry referencing the Python installer.

1_b3aNgKJzR3LlFBa_pwMj5Q.png

Answer 5: Z:\setups\python-3.8.2.exe

Question 6

Question:
 When was the USB device with the friendly name “USB” last connected?

This question was more challenging.

I started with the SYSTEM hive:

Hive Location:
 C:\Windows\System32\Config\SYSTEM

Relevant Key Path:
 SYSTEM\CurrentControlSet\Enum\USBSTOR

Initially, no device appeared with the friendly name “USB.”

1_zeR8Ezi6vB6GQI277fhHaw.png

After checking each USB entry, I found a few devices but not the one with the correct name.

The next step was to examine another hive for additional device information.

Hive Location:
 C:\Windows\System32\Config\SOFTWARE

Relevant Key Path:
 SOFTWARE\Microsoft\Windows Portable Devices\Devices

Here, I found the actual friendly name I was looking for — but not the last connection time.

1_ROr_4ZYIvpBlvGXXonXwbQ.png

By correlating the device’s GUID back in the USBSTOR registry path, I identified the correct device and timestamp.

1_Mlux831zG59TrlobRuLUjw.png

It turned out to be the Kingston DataTraveler device.

Answer 6: 2021–11–24 18:40:06

Conclusion

This investigation confirmed suspicious activity on the system, including the presence of an unexpected user account and a connected external USB drive.
 Through analyzing the SAM, SYSTEM, SOFTWARE, and NTUSER.DAT hives, I successfully located and interpreted key forensic artifacts relevant to the case.

Working on this challenge strengthened my practical understanding of Windows Registry analysis, artifact correlation, and triage workflows ;  all crucial skills for a SOC analyst or digital forensics investigator.

You may also like

CyberDefenders CCDL1:  Practical SOC Analyst Training Beyond the Fundamentals
8 min read

CyberDefenders CCDL1:  Practical SOC Analyst Training Beyond the Fundamentals

A hands-on path into modern blue team operations

Raúl Vázquez González's Picture
Raúl Vázquez González in soc-analyst blue-team dfir siem certifications
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
9 min read

Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2

A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.

Raúl Vázquez González's Picture
Raúl Vázquez González in dfir phishing malware-analysis volatility
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
3 min read

TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction

Complete writeup with binary analysis, string decoding, and DFIR techniques

Raúl Vázquez González's Picture
Raúl Vázquez González in malware-analysis dfir incident-response tryhackme

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr