SysInternals Tools Registry Forensics

SysInternals Tools - Registry Forensics and Analysis

What is SysInternals?

SysInternals is a suite of advanced system utilities for Microsoft Windows that provides deep technical insight into the operating system. These tools are designed to help IT professionals, system administrators, and software developers manage, troubleshoot, and diagnose Windows systems effectively. From process management to network monitoring, SysInternals offers a wide range of utilities that enhance system performance, security, and reliability.

Key Features of SysInternals Tools

The SysInternals suite includes a diverse set of tools that cater to various system management needs:

• Process Management: Tools like Process Explorer and Process Monitor offer detailed insights into running processes, threads, and system activity.
• Network Monitoring: Utilities like TCPView and PsPing help monitor network connections, diagnose network issues, and optimize performance.
• Security Analysis: Tools like Autoruns and AccessChk provide in-depth security analysis, including permissions, autorun configurations, and more.
• File System Management: Utilities like Disk2vhd and DiskView assist in managing disk space, analyzing disk usage, and creating virtual hard disks.
• Registry Tools: Tools like Regmon and RegDelNull help analyze and manage the Windows Registry, including monitoring registry activity and deleting problematic keys.

How to Use SysInternals Tools

Using SysInternals tools is straightforward and typically involves downloading the desired utility from the official Microsoft website. As of Windows 11, the Microsoft Store contains an AppPackage that can be installed. The package installs/downloads the tools to C:\Users\%username%\AppData\Local\Microsoft\WindowsApps\SysinternalsSuite.

Once downloaded, the tool can be run directly from the executable file without requiring installation. You can leverage the command-line interface or graphical user interface (GUI) to interact with the tool. Each tool comes with detailed documentation and usage instructions to help make the most of its capabilities.

Registry Keys Affected

Below are the common registry keys affected by each SysInternals tool:

In the registry keys below, the USER-SID-1001 is a placeholder for the user’s Security Identifier (SID) and will vary depending on the user’s profile. The USER-SID-1001 is used as an example in this case, showing strings as an example for the registry keys affected by the SysInternals tools.

When one of the tools is used for the first time, the registry keys are created in the HKU hive, which is the user’s profile hive. The HKU hive is a subkey of the HKEY_USERS hive, containing user-specific settings for each user who is currently logged on. The HKU hive is loaded when a user logs on and is specific to the user who is currently logged on. The HKU hive is unloaded when the user logs off and is stored in the C:\Users\%username%\NTUSER.DAT file. If you want more information on User Hive Data, click here.

Registry Keys Added

• The registry subkey HAM\AUI is a placeholder for the HostActivityManager\ActivityUserInformation.

\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\CommitHistory\Microsoft.SysinternalsSuite_8wekyb3d8bbwe!strings

• The registry subkey LU is a placeholder for the LocalUser.

Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU

• The registry subkey Strings is a placeholder for the tool when used.

\Software\Sysinternals\Strings

Registry Values Added

The PCT and PTT values are used to store process creation and termination times, respectively. These values are stored in LE hexadecimal format and represent the timestamp data for the process.

• PCT:

  • Hex: 42 54 33 2D 75 5C DB 01
  • Date: 2025-01-01 12:47:07.6829250 -05:00

• PTT:

  • Hex: 80 B7 35 2D 75 5C DB 01
  • Date: 2025-01-01 12:47:07.6985728 -05:00

In the Current User

• Mixed: This registry value holds mixed data types, which could include various forms of information necessary for the functioning of associated programs or settings. The hexadecimal data here indicates that the Mixed value is set to zero, implying no mixed data types are stored in this key at this moment.

Microsoft.SysinternalsSuite_8wekyb3d8bbwe!strings\Mixed:
 - 00 00 00 00 00 00 00 00

• Process Creation Time (PCT): This registry value logs the exact time when a process was initiated. The hexadecimal sequence represents timestamp data, which is used to track when a process began execution.

Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PCT:
 - 42 54 33 2D 75 5C DB 01

• Process Termination Time (PTT): This registry value records the exact time when a process ended. Like PCT, the PTT value uses hexadecimal data to record the termination timestamp of a specific process.

Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PTT:
 - 80 B7 35 2D 75 5C DB 01

• The data held in EulaAccepted represents a placeholder indicating whether the End User License Agreement (EULA) has been accepted. If this becomes 0x00000001, it means the EULA has been accepted. If it is 0x00000000, it means the EULA has not been accepted and will prompt a popup when executed.

Sysinternals\Strings\EulaAccepted:
 - 0x00000001

In the Current User Classes

Key: Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PCT
Value: 42 54 33 2D 75 5C DB 01

Key: Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PTT
Value: 80 B7 35 2D 75 5C DB 01

Key: HKU\S-1-5-21-USER-SID-1001\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\CommitHistory\Microsoft.SysinternalsSuite_8wekyb3d8bbwe!strings\Mixed
Value: 00 00 00 00 00 00 00 00

Key: HKU\S-1-5-21-USER-SID-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PCT
Value: 42 54 33 2D 75 5C DB 01

Key: HKU\S-1-5-21-USER-SID-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SysinternalsSuite_8wekyb3d8bbwe\HAM\AUI\strings\V1\LU\PTT
Value: 80 B7 35 2D 75 5C DB 01

Key: HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-USER-SID-1001\Microsoft.SysinternalsSuite_8wekyb3d8bbwe
Value: 87 39 25 B4 74 5C DB 01 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00

Key: HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-USER-SID-1001\Microsoft.SysinternalsSuite_8wekyb3d8bbwe
Value: B0 7F 2F 2F 75 5C DB 01 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00

Secondary, you can always find file usage in the prefetch:

• C:\WINDOWS\Prefetch\STRINGS.EXE-1BD7A361.pf

SysInternals Tools Reference