reg.exe
Sources: 300M+ executions observed in the wild.
Summary
Registry Console Tool (reg.exe) is the command-line interface for viewing, adding, modifying, and deleting Windows registry keys and values. It provides direct access to the registry for scripting and automation.
reg.exe is the 120th most commonly executed Windows program in EchoTrail's dataset, observed 180,832 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by Yammer.exe.
Get this in your tools
The same record for reg.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/reg.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3289.27%
- C:\Windows\SysWOW6410.73%
Top Hashes (SHA256)
- 6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f54.7%
- e15ed545e21b304df6a31e8c01f74495b43ac275ea9572911c1fd286a363e4af10.63%
- 19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf10.13%
- c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d6.11%
- 928693d84d652dc15b3fcdc6576d790053755c5181ce6708b1110de12adae4a14.02%
- 405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e43.4%
- 224a746aee2957c3fca376f4457cfc044c1ec99e75756195b27cab396174e2db3.15%
- c6a168c81654f5901e864c8fd61fa54f084cd8b2e0a8ac1b83eacf9eb4484f751.02%
- 4ed2a27860fa154415f65452ff1f94bd6af762982e2f3470030c504dc3c8a3541.01%
- 849f54dc526ea18d59abaf4904cb11bc15b982d2952b971f2e1b6fbf8c974b390.71%
Process Ancestry
Top Grandparents
- Update.exe89.98%
- services.exe2.59%
- explorer.exe1.58%
- powershell.exe0.43%
- cmd.exe0.4%
- Nuix-Config.exe0.38%
- Yammer.exe0.29%
- wscript.exe0.22%
- PylumLoader.exe0.22%
- nvnodejslauncher.exe0.18%
Top Parents
- Yammer.exe68.18%
- cmd.exe14.85%
- powershell.exe5.06%
- Skype.exe2.13%
- msiexec.exe1.88%
- RingCentral.exe0.93%
- cscript.exe0.9%
- Discord.exe0.62%
- Nuix-Config.exe0.6%
- optimumdesk.exe0.52%
Top Children
- conhost.exe100%
Security Analysis
What does reg.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. In this dataset, heavily used by Yammer.exe and Skype.exe (reading/writing app settings). Also launched by cmd.exe and powershell.exe for administration. Spawns conhost.exe.
When is reg.exe suspicious?
Modifying Run/RunOnce keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) — persistence. Querying or exporting SAM, SECURITY, or SYSTEM hives (reg save HKLM\SAM) — credential access. Disabling security features (reg add ... DisableAntiSpyware, DisableRealtimeMonitoring). Modifying firewall or UAC registry settings. Adding Image File Execution Options (IFEO) debugger entries.
How do attackers abuse reg.exe?
Persistence: adding entries to Run/RunOnce keys, Winlogon registry values, or shell extension handlers to execute malware at startup or logon. Credential theft: reg save HKLM\SAM, reg save HKLM\SECURITY, reg save HKLM\SYSTEM to extract password hashes offline. Defense evasion: disabling Windows Defender, AMSI, UAC, or firewall via registry modifications. Discovery: reg query to enumerate installed software, security configurations, and system settings.
Detection guidance
High-confidence: reg save targeting SAM, SECURITY, or SYSTEM hives. reg add modifying Windows Defender or AMSI registry keys to disable them. reg add to Run/RunOnce keys with paths to temp or user profile directories. Medium-confidence: reg add to IFEO keys (potential debugger persistence). reg query targeting security product configuration keys. Monitor Sysmon Event ID 13 (RegistryValueSet) and Event ID 12 (RegistryObject create/delete) for the underlying registry changes.
False positive notes
Applications (Yammer, Skype, Office) read and write their own registry settings heavily. Software installers modify many registry keys during installation. GPO enforcement modifies registry settings. Focus on specific high-value registry paths rather than all reg.exe activity.
Related Processes
Ask Rocky about reg.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for reg.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.