EnCE Registry Analysis 3 — Questions and Answers
Question 1: What encoding method obfuscates the program paths and GUIDs stored in the UserAssist registry key?
- Base64 encoding
- ROT13 cipher (Correct answer)
- XOR with a static key
- MD5 hashing
Correct answer: ROT13 cipher
UserAssist program paths are encoded with ROT13, a simple Caesar cipher shifting each letter by 13 positions, which is trivially reversible.
Question 2: Which registry key path stores UserAssist entries that track GUI-launched program executions per user?
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist (Correct answer)
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\UserAssist
- HKLM\SYSTEM\CurrentControlSet\Control\UserAssist
Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
UserAssist is stored per-user under HKCU in the Explorer branch, recording run counts and last execution timestamps for each program launched via the shell.
Question 3: What unique forensic value do Shellbag registry entries provide that other artifacts cannot reliably offer?
- They record the MD5 hash of every file accessed inside a folder
- They preserve evidence that a folder existed and was browsed even after the folder is deleted (Correct answer)
- They log the username who accessed each folder with a timestamp
- They capture the file listing of a folder at the time of access
Correct answer: They preserve evidence that a folder existed and was browsed even after the folder is deleted
Shellbags retain window size, view preferences, and access history for folders regardless of whether those folders still exist on the filesystem.
Question 4: Where are the primary Shellbag entries located in the registry on Windows Vista and later systems?
- HKLM\SOFTWARE\Microsoft\Windows\Shell\BagMRU
- HKCU\Software\Microsoft\Windows\Shell\BagMRU
- HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU (Correct answer)
- HKLM\SYSTEM\CurrentControlSet\Shell\BagMRU
Correct answer: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
On Vista and later, the primary Shellbag location is HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU.
Question 5: Which registry key records URLs typed directly into the Internet Explorer or legacy Edge address bar?
- HKLM\SOFTWARE\Microsoft\Internet Explorer\TypedURLs
- HKCU\Software\Microsoft\Internet Explorer\TypedURLs (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedURLs
- HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\History
Correct answer: HKCU\Software\Microsoft\Internet Explorer\TypedURLs
TypedURLs is stored in HKCU under the Internet Explorer branch and records up to 25 URLs manually entered into the address bar.
Question 6: What information does the HKCU\Network registry key reveal during a forensic investigation?
- A history of all network packets sent by the user
- Mapped network drives including drive letters and UNC remote paths (Correct answer)
- The list of wireless SSIDs the user has connected to
- DNS query history for the current user session
Correct answer: Mapped network drives including drive letters and UNC remote paths
HKCU\Network contains subkeys named by drive letter, each recording the UNC remote path, username, and provider for persistent mapped network drive connections.
Question 7: Which registry key is most frequently abused by malware to achieve persistence across Windows reboots?
- HKLM\SYSTEM\CurrentControlSet\Services
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Correct answer: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and its HKCU counterpart) is the most commonly abused autorun key because every entry executes at every Windows startup.
EnCE Registry Analysis 3
What encoding method obfuscates the program paths and GUIDs stored in the UserAssist registry key?