NtQueryKey

Prototype

NTSTATUS NtQueryKey(
  HANDLE                KeyHandle,
  KEY_INFORMATION_CLASS KeyInformationClass,
  PVOID                 KeyInformation,
  ULONG                 Length,
  PULONG                ResultLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 16 00 00 00      mov eax, 0x16
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Notably, NtQueryKey's SSN has been pinned at `0x16` from Windows 10 1507 through Windows 11 24H2 — one of the most stable numbers in the SSDT, which makes a hardcoded SSN safe across builds. The KEY_FULL_INFORMATION variant returns LastWriteTime as a FILETIME, the count of subkeys / values, and the maximum lengths of each — the same numbers `reg query` and Sysinternals `regjump` rely on.

Common malware usage

Three flavors of abuse. (1) *Forensic timestomp detection avoidance*: an operator can read LastWriteTime before tampering with a value, then use NtSetInformationKey (KeyWriteTimeInformation) to restore it. (2) *Enumeration tooling*: registry-walking implants pair NtEnumerateKey + NtQueryKey to recurse a subtree and identify high-value targets (autoruns, services, AppCompat shims). (3) *Sandbox fingerprinting*: query keys like `HKLM\HARDWARE\DESCRIPTION\System\BIOS` and inspect LastWriteTime to spot freshly-built analysis VMs.

Detection opportunities

Standalone NtQueryKey is high-volume background noise — Explorer alone calls it tens of thousands of times an hour. The valuable signal is the *write* that follows: KeyWriteTimeInformation set via NtSetInformationKey is rare in legitimate workloads and almost diagnostic of timestomp. EDRs hooking CmRegisterCallbackEx see RegNtPostQueryKey but most ignore it for cost reasons. ETW Microsoft-Windows-Kernel-Registry RegistryQueryKey is available but disabled by default. Hunting tip: process-handle inventory showing a non-Explorer, non-svchost process holding hundreds of open registry handles is a better lead than any single NtQueryKey call.

Direct syscall examples

// Capture the original LastWriteTime before tampering with a value,
// so it can be restored via NtSetInformationKey afterward.
KEY_BASIC_INFORMATION* kbi = (KEY_BASIC_INFORMATION*)buf;
ULONG ret = 0;
NTSTATUS st = NtQueryKey(hKey, KeyBasicInformation, kbi, sizeof(buf), &ret);
if (NT_SUCCESS(st)) {
    g_savedWriteTime = kbi->LastWriteTime;
}

NtQueryKey PROC
    mov  r10, rcx
    mov  eax, 16h
    syscall
    ret
NtQueryKey ENDP

// Cargo: ntapi = "0.4"
let mut needed: u32 = 0;
let status = unsafe {
    NtQueryKey(h_key,
        KeyFullInformation,
        null_mut(),
        0,
        &mut needed)
};
assert_eq!(status, STATUS_BUFFER_TOO_SMALL as i32);
let mut buf = vec![0u8; needed as usize];
let status = unsafe {
    NtQueryKey(h_key,
        KeyFullInformation,
        buf.as_mut_ptr() as _,
        buf.len() as u32,
        &mut needed)
};
assert!(status == 0);

MITRE ATT&CK mappings

• T1012Query Registrymitre ↗
• T1082System Information Discoverymitre ↗
• T1497Virtualization/Sandbox Evasionmitre ↗