Registry - WordWheelQuery

 

The Registry Section of WordWheelQuery: An Overview for Digital Forensic Investigators

The WordWheelQuery registry section is a critical component for digital forensic investigations, as it contains information about the user's search queries made using the Windows operating system. In this blog post, we'll take a closer look at what exactly can be found in the WordWheelQuery registry section and its significance for both normal and malicious use cases.

 

Finding the WordWheelQuery Registry

What is the Significance of the Registry Section of WordWheelQuery?

The registry section of WordWheelQuery is significant for digital forensic investigations because it contains information about the file paths and search terms that have been entered into the Windows search bar. This information can be used to track the user's activities and to determine what files they have been accessing and searching for.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery	

Taking a look at the image below. You can see the registry query for WordWheelQuery making the search for Test_WordWheelQ2 in the explorer search bar. Looking at entry 1, we have the hex showing with it's relevant null bytes that everyone loves. 

Just below entry 0 and Entry 1, we have the MRUListEx (Most Recently Used List Executed) in it's sequential order of 01 00 as in 01 was used most recent and 00 used originally.

Normal Use Case

   In a normal use case, a digital forensic investigator would want to find information about the user's search queries in order to gain insight into their online behavior and activities. This information can be useful for various purposes such as identifying any potential privacy breaches, uncovering any evidence of intellectual property theft, or determining the user's online habits and interests.

For example, if a digital forensic investigator is conducting an investigation into a suspected data breach, they may want to examine the WordWheelQuery registry section to determine what search queries the user made that may have led to the compromise of their information. If the user searched for sensitive information such as login credentials or financial information, this could indicate that they may have fallen victim to a phishing scam or other type of malicious activity.

Malicious Use Case

   In a malicious use case, a digital forensic investigator may want to examine the WordWheelQuery registry section to determine if the user's computer has been infected with malware. Malware can often manipulate the WordWheelQuery registry section to hide its presence and steal sensitive information, such as login credentials or financial information.

• For example, if a digital forensic investigator is conducting an investigation into a suspected malware infection, they may want to examine the WordWheelQuery registry section to determine if any suspicious or unusual search queries have been made. If the user searched for terms related to malware or hacking, this could indicate that they may have been attempting to infect their own computer or were searching for information on how to remove an infection.

• Another example of a malicious use case is the use of the WordWheelQuery registry section by an attacker to hide their tracks and cover up their activities. An attacker may manipulate the WordWheelQuery registry section to hide their search queries and cover up their tracks. This can be accomplished by modifying the information stored in the WordWheelQuery registry section to reflect search queries that are not related to their actual activities.

    In conclusion, the WordWheelQuery registry section is a valuable source of information for digital forensic investigations. Whether the investigation is focused on a normal use case or a malicious use case, the information stored in this section can provide valuable insight into the user's online behavior and activities. Digital forensic investigators should always consider examining the WordWheelQuery registry section as part of their investigations, as it can often provide critical evidence that can help to uncover the truth.

https://www.sans.org/posters/windows-forensic-analysis/