NtFreezeRegistry

Prototype

NTSTATUS NtFreezeRegistry(
  ULONG TimeOutInSeconds
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 F7 00 00 00      mov eax, 0xF7      ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtFreezeRegistry` quiesces the configuration manager (`CmpRegistryFreeze`): new writers are stalled and pending lazy-flushes are completed, so that on-disk hives are coherent for the duration of the freeze. The single argument is a safety timeout — if the caller (or whatever it spawns) crashes without calling `NtThawRegistry`, the kernel auto-thaws after `TimeOutInSeconds` to keep the system usable. Requires `SeBackupPrivilege`. The intended consumer is the Volume Shadow Copy Service (VSS) writer for the registry (`%SystemRoot%\System32\Vssapi.dll` registry writer), which freezes the registry, snapshots the hive volume, then thaws.

Common malware usage

Weak in-the-wild signal — there is no publicly documented commodity malware family that calls `NtFreezeRegistry` outright. Research-grade abuse scenarios exist: (1) brief denial-of-service against monitoring tools that poll the registry for state (Sysmon, AV self-protection), (2) winning a TOCTTOU race against an EDR that scans Run keys on a schedule by freezing the registry across the moment of write, (3) ensuring a registry-persistence payload is committed to disk atomically before snapshot collection. All require `SeBackupPrivilege`, which is high-integrity / admin, so this is a post-exploitation primitive, not initial-access.

Detection opportunities

Direct invocation outside of VSSVC.exe / SystemWriter and a small number of backup products (Veeam, Acronis, Veritas, Commvault) is extremely unusual. ETW Microsoft-Windows-Kernel-Registry does not natively log freeze/thaw, but Microsoft-Windows-VolumeSnapshot-Driver and the VSS application log (`Microsoft-Windows-VSS/Operational`) record the orchestration around it. Sysmon Event 1 (process create) showing an unexpected binary holding `SeBackupPrivilege` immediately followed by a registry freeze is a strong tell. Pair with monitoring for a missing `NtThawRegistry` within the timeout window.

Direct syscall examples

// Requires SeBackupPrivilege already enabled in the token.
NTSTATUS Snapshot(void) {
    NTSTATUS st = NtFreezeRegistry(60);     // auto-thaw safety: 60s
    if (!NT_SUCCESS(st)) return st;

    // ... take volume snapshot of the hive partition here ...

    return NtThawRegistry();
}

; NtFreezeRegistry direct syscall (Win11 24H2 SSN 0xF7)
NtFreezeRegistry PROC
    mov  r10, rcx           ; TimeOutInSeconds
    mov  eax, 0F7h
    syscall
    ret
NtFreezeRegistry ENDP

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1106Native APImitre ↗