windows enabled community medium v1.0.0

regini

Used to manipulate the registry Located at: C:\Windows\System32\regini.exe; C:\Windows\SysWOW64\regini.exe.

📋 Live Preview 
regini
regini

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.alternate-data-stream

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_write

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Write registry keys from data inside the Alternate data stream. (Write to registry)

regini.exe {PATH}:hidden.ini

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_ads.yml
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_execution.yml
ioc regini.exe reading from ADS

Documentation

regini

regini is a Windows LOLBin. Used to manipulate the registry Located at: C:\Windows\System32\regini.exe; C:\Windows\SysWOW64\regini.exe.

References