TDCTF Academy Logo TDCTF ACADEMY
@farishhz

Lab 9: Windows Registry Forensics - Menganalisis Registry untuk Menemukan Bukti Aktivitas

Target Skill: Mahasiswa mampu menganalisis Windows Registry hives untuk mengekstrak bukti seperti program yang dijalankan, USB terpasang, dan user activity
Tools: reglookup, python3, sleuthkit
Durasi: 30 menit
Level: Beginner

Mengapa Registry Forensics Penting?

Windows Registry adalah database konfigurasi yang menyimpan hampir semua pengaturan Windows:

  • Program apa saja yang pernah diinstall
  • File apa yang baru dibuka
  • USB device apa yang pernah dicolok
  • User account dan password hash
  • Network drives yang terhubung
  • Startup programs

Bagi investigator, registry adalah kunci utama untuk merekonstruksi aktivitas user di Windows.

Learning Objectives

  1. Memahami struktur Windows Registry hives
  2. Mengekstrak MRU (Most Recently Used) list
  3. Menemukan USB device history
  4. Menganalisis startup programs
  5. Mendeteksi malware persistence mechanism

️ Tools & Setup

sudo apt install -y reglookup sleuthkit
pip3 install python-registry 2>/dev/null || pip install python-registry 2>/dev/null

Langkah Praktikum

Step 1: Teori - 5 Main Registry Hives

cd ~ && mkdir forensics-lab9 && cd forensics-lab9

echo "=== 5 Registry Hives Utama ==="
cat << 'INFO'
HKEY_LOCAL_MACHINE\SYSTEM - Info sistem, services, USB devices
HKEY_LOCAL_MACHINE\SOFTWARE - Software terinstall, konfigurasi
HKEY_LOCAL_MACHINE\SAM - User account & password hashes (terproteksi)
HKEY_CURRENT_USER\Software - User-specific settings
HKEY_USERS\.DEFAULT - Default user profile

=== Key Forensik Penting ===
NTUSER.DAT   → User-specific registry (C:\Users\<user>\NTUSER.DAT)
SAM          → User credentials (C:\Windows\System32\config\SAM)
SYSTEM       → System info (C:\Windows\System32\config\SYSTEM)
SOFTWARE     → Software info (C:\Windows\System32\config\SOFTWARE)
INFO

Step 2: Buat Simulasi Registry Data - MRU Analysis

Kita buat data MRU (Most Recently Used) simulasi:

python3 << 'PYEOF'
# Simulasi data registry - MRU (Most Recently Used)
print("=== Simulasi Registry MRU - File yang Baru Dibuka ===")
print()

# Ini mensimulasikan data dari:
# NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

mru_files = [
    ("1", "laporan_keuangan_q3.xlsx", "2026-06-18 09:15:32"),
    ("2", "data_karyawan.csv", "2026-06-18 09:10:15"),
    ("3", "passwords.txt", "2026-06-18 09:05:44"),
    ("4", "kartu_kredit_nasabah.xlsx", "2026-06-18 08:55:00"),
    ("5", "backdoor.exe", "2026-06-18 08:30:00"),
    ("6", "server_config.ini", "2026-06-17 17:00:00"),
    ("7", "README.md", "2026-06-17 16:45:00"),
]

print(f"{'MRU':<8} {'File':<35} {'Waktu':<20}")
print("-"*63)
for mru, file, time in mru_files:
    suspicious = " ← ⚠️" if any(x in file.lower() for x in ['password', 'kartu_kredit', 'backdoor']) else ""
    print(f"{mru:<8} {file:<35} {time:<20}{suspicious}")

print()
print("📌 Analisis:")
print("- 'passwords.txt' - kemungkinan file password")
print("- 'kartu_kredit_nasabah.xlsx' - data sensitif perbankan")
print("- 'backdoor.exe' - executable mencurigakan baru dibuka")
PYEOF

Step 3: Simulasi - USB Device History

python3 << 'PYEOF'
# Simulasi USB device history dari registry:
# SYSTEM\CurrentControlSet\Enum\USBSTOR

print("=== USB Device History (USBSTOR) ===")
print()

usb_devices = [
    ("USB\\VID_0781&PID_5583\\AA1234567890", "SanDisk Cruzer Blade 16GB", "2026-06-15 14:30:00", "FIRST_INSTALL"),
    ("USB\\VID_0930&PID_6545\\BB9876543210", "Toshiba TransMemory 32GB", "2026-06-16 10:00:00", "FIRST_INSTALL"),
    ("USB\\VID_0781&PID_5583\\AA1234567890", "SanDisk Cruzer Blade 16GB", "2026-06-17 08:15:00", "LAST_REMOVAL"),
    ("USB\\VID_048D&PID_1234\\CC5555666677", "Unknown Device (VID_048D)", "2026-06-18 01:30:00", "FIRST_INSTALL"),  # 01:30 AM!
    ("USB\\VID_048D&PID_1234\\CC5555666677", "Unknown Device (VID_048D)", "2026-06-18 02:15:00", "LAST_REMOVAL"),
]

print(f"{'Device ID':<50} {'Desc':<30} {'Waktu':<22} {'Event'}")
print("-"*130)
for dev_id, desc, time, event in usb_devices:
    suspicious = " ← 🚩 Tengah Malam!" if "01:30" in time or "02:15" in time else ""
    print(f"{dev_id:<50} {desc:<30} {time:<22} {event}{suspicious}")

print()
print("📌 Analisis Forensik:")
print("1. Flashdisk SanDisk dipasang beberapa kali - aktivitas normal")
print("2. 🚩 Device tidak dikenal (VID_048D) dipasang jam 01:30 AM!")
print("3. Dipasang dan dicabut dalam 45 menit - kemungkinan copy file")
print("4. Vendor ID 048D perlu dicek - bukan vendor storage umum")
PYEOF

Step 4: Simulasi - Network Drives & Shares

python3 << 'PYEOF'
# Simulasi network shares dari registry:
# NTUSER.DAT\Network\ (mapped drives)

print("=== Network Mapped Drives ===")
print()

drives = [
    ("Z:", r"\\192.168.0.100\databackup", "2026-06-10"),
    ("Y:", r"\\file-server\public", "2026-06-11"),
    ("X:", r"\\192.168.1.200\c$", "2026-06-18 03:00:00"),  # Admin share tengah malam!
]

print(f"{'Drive':<10} {'Path':<40} {'First Mapped'}")
print("-"*65)
for drive, path, time in drives:
    suspicious = " ← 🚩 Admin share dari IP eksternal!" if "c$" in path else ""
    print(f"{drive:<10} {path:<40} {time:<30}{suspicious}")

print()
print("📌 Analisis:")
print("🚩 192.168.1.200 adalah IP attacker dari lab sebelumnya!")
print("🚩 Admin share (c$) bisa akses seluruh drive C:")
print("🚩 Dipasang jam 3 pagi - indikasi aktivitas ilegal")
PYEOF

Step 5: Simulasi - Program Execution (UserAssist)

python3 << 'PYEOF'
# UserAssist - mencatat program apa saja yang dijalankan
# NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

print("=== UserAssist - Program Execution History ===")
print()

programs = [
    ("chrome.exe", 45, "2026-06-18 08:00:00"),
    ("explorer.exe", 30, "2026-06-18 07:55:00"),
    ("cmd.exe", 15, "2026-06-18 07:30:00"),
    ("powershell.exe", 10, "2026-06-18 07:31:00"),
    ("notepad.exe", 3, "2026-06-18 07:35:00"),
    ("mimikatz.exe", 1, "2026-06-18 07:32:00"),     # Password dumping tool!
    ("procdump.exe", 1, "2026-06-18 07:33:00"),      # Process dumping
    ("nc.exe", 1, "2026-06-18 07:34:00"),             # Netcat - reverse shell
]

print(f"{'Program':<25} {'Run Count':<12} {'Last Executed':<22}")
print("-"*60)
for prog, count, time in programs:
    suspicious = " ← 🚩 TOOL ATTACK!" if prog in ['mimikatz.exe', 'procdump.exe', 'nc.exe'] else ""
    print(f"{prog:<25} {count:<12} {time:<22}{suspicious}")

print()
print("📌 Analisis Forensik:")
print("🚩 Mimikatz (dumping password), Procdump (dump process), nc.exe (reverse shell)")
print("🚩 Semua tool dieksekusi dalam 4 menit - serangan terencana")
PYEOF

Step 6: Simulasi - Startup Programs (Persistence)

python3 << 'PYEOF'
# Startup programs dari registry:
# HKLM\Software\Microsoft\Windows\CurrentVersion\Run
# HKCU\Software\Microsoft\Windows\CurrentVersion\Run

print("=== Startup Programs (Autorun) ===")
print()

startup = [
    ("HKCU\\...\\Run", "WindowsDefender", "C:\\Program Files\\Windows Defender\\MSASCui.exe", "Normal"),
    ("HKCU\\...\\Run", "OneDrive", "C:\\Users\\user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", "Normal"),
    ("HKCU\\...\\Run", "GoogleChromeAutoLaunch", "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "Normal"),
    ("HKLM\\...\\Run", "svchost", "C:\\Windows\\Tasks\\svchost.exe", "🚩 FAKE - malware persistence!"),
    ("HKLM\\...\\Run", "WindowsUpdate", "C:\\Users\\user\\AppData\\Roaming\\winupdate.exe", "🚩 FAKE - startup mencurigakan!"),
]

print(f"{'Hive':<45} {'Name':<25} {'Path':<65} {'Status'}")
print("-"*160)
for hive, name, path, status in startup:
    print(f"{hive:<45} {name:<25} {path:<65} {status}")

print()
print("📌 Analisis Forensik:")
print("🚩 'svchost.exe' dari C:\\Windows\\Tasks\\ - ASLI di C:\\Windows\\System32\\")
print("🚩 'winupdate.exe' dari AppData\\Roaming - bukan lokasi Windows Update")
print("🚩 Kedua file ini akan jalan SETIAP KALI Windows startup = PERSISTENCE!")
PYEOF

Step 7: Praktik - Analisis Registry dengan RegLookup

Kita buat file registry simulasi dalam format CSV (mirip output reglookup):

# Buat dump registry simulasi
python3 << 'PYEOF'
import csv, os

rows = [
    # Path, Type, Data
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.txt/MRUListEx", "REG_BINARY", "0300000002000000..."),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.txt/0", "REG_SZ", "passwords.txt"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.txt/1", "REG_SZ", "notes.txt"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.txt/2", "REG_SZ", "README.txt"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.xlsx/0", "REG_SZ", "kartu_kredit_nasabah.xlsx"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.exe/0", "REG_SZ", "backdoor.exe"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.exe/1", "REG_SZ", "mimikatz.exe"),
    ("/NTUSER/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.exe/2", "REG_SZ", "nc.exe"),
    ("/SYSTEM/CurrentControlSet/Enum/USBSTOR/Ven_Prod_V1/Serial1/Properties/{83da6326-97a6-4088-9453-a1923f573b29}/0064", "REG_DWORD", "1"),
    ("/SYSTEM/CurrentControlSet/Enum/USBSTOR/Ven_Prod_V1/Serial1/FriendlyName", "REG_SZ", "SanDisk Cruzer Blade 16GB"),
    ("/SYSTEM/CurrentControlSet/Enum/USBSTOR/Ven_Unknown_V2/Serial2/FriendlyName", "REG_SZ", "Unknown Device (VID_048D)"),
    ("/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/svchost", "REG_SZ", "C:\\Windows\\Tasks\\svchost.exe"),
    ("/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/WindowsUpdate", "REG_SZ", "C:\\Users\\User\\AppData\\Roaming\\winupdate.exe"),
]

with open('registry-dump.csv', 'w', newline='') as f:
    writer = csv.writer(f)
    writer.writerow(['Path', 'Type', 'Data'])
    writer.writerows(rows)

print("✅ registry-dump.csv - simulasi reglookup output")
print(f"   {len(rows)} entries")
PYEOF

# Analisis dengan grep & awk (seperti analisis reglookup asli)
echo ""
echo "=== Analisis Registry Dump ==="

# Cari file terbaru yang dibuka
echo "--- MRU: Files Baru Dibuka ---"
grep "RecentDocs" registry-dump.csv | grep -v MRUListEx

echo ""
echo "--- USB Devices Terpasang ---"
grep "USBSTOR" registry-dump.csv

echo ""
echo "--- Startup Programs (Persistence) ---"
grep "CurrentVersion/Run" registry-dump.csv

echo ""
echo "=== KESIMPULAN ==="
echo "🚩 File mencurigakan: passwords.txt, backdoor.exe, mimikatz.exe, nc.exe"
echo "🚩 USB tidak dikenal: VID_048D"
echo "🚩 Persistence: svchost.exe palsu + winupdate.exe palsu"

️ Analisis & Pertanyaan

1. Registry Forensics - Key Areas

Registry Key Forensik Value
RecentDocs File apa saja yang baru dibuka (MRU)
USBSTOR Semua USB yang pernah dipasang
UserAssist Program yang pernah dijalankan
Run / RunOnce Program yang jalan saat startup (persistence)
Network Network drives yang ter-mount
Ports Port serial / COM yang terpakai
SAM User account & password hashes

2. Malware Persistence di Registry

Location Example Risk
HKLM\...\Run svchost.exe dari Tasks\ High
HKCU\...\Run winupdate.exe dari Roaming\ High
HKLM\...\RunOnce Satu kali jalan Medium
HKLM\...\Services Service palsu Critical
HKLM\...\Winlogon\Shell Ganti shell Critical

Laporan Temuan

Finding 1: Malware Execution via UserAssist (Critical)

Parameter Value
Program mimikatz.exe, procdump.exe, nc.exe
Hive NTUSER.DAT
Key UserAssist{GUID}\Count
Count 1 (masing-masing, dijalankan sekali)
Timing 07:32 - 07:34 (berurutan, dalam 4 menit)

Dampak: Password dumping + reverse shell dalam 4 menit

Finding 2: Persistence via Fake Service Name (High)

Parameter Value
Key HKLM...\Run
Name "svchost.exe" (palsu)
Path C:\Windows\Tasks\svchost.exe
Real Path C:\Windows\System32\svchost.exe
Taktik Masquerading (nama mirip service asli)

Dampak: Malware jalan otomatis setiap Windows startup

Korelasi OWASP / CWE / CAPEC

Kerangka ID Deskripsi
CWE CWE-200 Exposure of Sensitive Information
CWE CWE-522 Insufficiently Protected Credentials
CWE CWE-269 Improper Privilege Management
CAPEC CAPEC-555 Registry Analysis
CAPEC CAPEC-575 USB Device Forensics
CAPEC CAPEC-578 Windows Registry Abuse

️ Remediasi

Ancaman Deteksi Pencegahan
Malware execution Monitor UserAssist + Prefetch Application whitelisting
USB theft Monitor USBSTOR + Event Log 4663 Block USB via policy
Registry persistence RegScanner, Autoruns Regular registry audit
Masquerading Path validation File signature verification 
# Tools Windows untuk analisis registry (native)
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

# Autoruns dari Sysinternals (tool wajib!)
# https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Kesimpulan & Refleksi

Apa yang dipelajari:

  • Registry adalah sumber intelijen utama di Windows
  • RecentDocs → file apa yang baru dibuka user
  • USBSTOR → USB device apa yang pernah dipasang
  • UserAssist → program apa yang dijalankan
  • Run keys → malware persistence mechanism

Refleksi untuk mahasiswa:

"Windows registry adalah catatan harian sistem operasi. Setiap program yang dijalankan, setiap USB yang dipasang, setiap file yang dibuka - semuanya tercatat. Sebagai investigator, registry adalah tempat pertama yang harus diperiksa di Windows. Sebagai defender, monitor perubahan registry adalah early warning system."

Referensi

🔬 Lab 9 Selesai! Lanjut ke Lab 10: Email Forensics

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy

← Sebelumnya Lab 8: Steganography Dasar - Menyembunyikan dan Menemukan Data dalam File Selanjutnya → Lab 10: Email Forensics - Menganalisis Header Email untuk Mendeteksi Phishing & Spoofing
PADA HALAMAN INI