1

ProcMon lists RegSetInfoKey as an "operation" on the registry. Process Monitor operations do not necessarily map directly to Native symbols, however, it seems that this operation uses NtSetInformationKey. When we examine that function though, we see that it has a parameter: IN KEY_SET_INFORMATION_CLASS InformationClass. Finally, undocumented.ntinternals.net states:

Currently only KEY_WRITE_TIME_INFORMATION is supported.

When we look up KEY_WRITE_TIME_INFORMATION, the definition is just a simple data structure which stores the last write time to the registry key. So the question then becomes, when ProcMon displays a last write time, but no RegSetKey or other write occurs, what is the purpose for setting this value and is a simple write to this member what is actually occurring?

closed as off-topic by Igor Skochinsky Aug 29 '17 at 8:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on software development are off-topic here, but can be asked on Stack Overflow." – Igor Skochinsky
If this question can be reworded to fit the rules in the help center, please edit the question.

  • @Igor Well I asked this from a reverse-engineering standpoint. I am not trying to use this function as a software developer and I worry that if I ask on SO, they will also close it because my intentions are reverse-engineering here. What do you think? – the_endian Sep 1 '17 at 22:55
1

As simple as it may sounds - calling NtSetInformationKey with the class KEY_WRITE_TIME_INFORMATION is simply used to modify the time a key was last modified.

The reason depends of context, but I can guess a couple:

  1. A malware wants to make sure a user investigating that registry will think it was there since a different time (either it was always there to make it look benign or it was just written to make a detected infection seem very new).
  2. A program uses the time as a "last update", and occasionally needs to modify it manually to fit some business logic.

You should use your imagination or whatever else you know about the program you're investigating to make up other reasons, it's fun! :D

Not the answer you're looking for? Browse other questions tagged or ask your own question.