NtThawRegistry

Prototype

NTSTATUS NtThawRegistry(VOID);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D4 01 00 00      mov eax, 0x1D4     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Zero-argument counterpart to `NtFreezeRegistry`. Hits `CmpRegistryThaw`, which releases the global freeze lock; pending writers that were blocked in the kernel `KeWaitForSingleObject` chain get unblocked. Also requires `SeBackupPrivilege`. Calling `NtThawRegistry` when the registry is not frozen returns `STATUS_INVALID_PARAMETER` — useful when probing whether a freeze is in effect (an unusual diagnostic an attacker might use to confirm the success of a paired `NtFreezeRegistry`).

Common malware usage

Same weak-signal caveat as `NtFreezeRegistry`: no widely reported commodity family uses it. The only realistic offensive patterns are paired use with a freeze (DoS, TOCTTOU race) or explicit cleanup after a malicious snapshot attempt to avoid leaving the system in a degraded state and tripping watchdogs. Note that the kernel auto-thaw timeout means an attacker who *only* freezes still has the system recover on its own; calling `NtThawRegistry` is essentially a politeness primitive.

Detection opportunities

Treat freeze/thaw as a pair. A `NtThawRegistry` event from a process that did not itself call `NtFreezeRegistry` (i.e. cleaning up someone else's mess) is itself anomalous. Detection rules should look for the *holder* of `SeBackupPrivilege` issuing freeze→thaw outside the well-known VSS writers (`VSSVC.exe`, `svchost.exe -k swprv`, vendor backup agents on a known allowlist).

Direct syscall examples

NTSTATUS st = NtFreezeRegistry(30);
if (NT_SUCCESS(st)) {
    do_snapshot_work();
    NtThawRegistry();    // explicit; the 30s timeout would also auto-thaw
}

; NtThawRegistry direct syscall (Win11 24H2 SSN 0x1D4)
NtThawRegistry PROC
    mov  r10, rcx
    mov  eax, 1D4h
    syscall
    ret
NtThawRegistry ENDP

// STATUS_INVALID_PARAMETER (0xC000000D) from NtThawRegistry means 'not frozen'.
use windows_sys::Win32::System::LibraryLoader::*;
type NtThawFn = unsafe extern "system" fn() -> i32;
unsafe fn is_frozen() -> bool {
    let nt = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let f: NtThawFn = std::mem::transmute(
        GetProcAddress(nt, b"NtThawRegistry\0".as_ptr()).unwrap()
    );
    // Caller must already have stored a prior freeze if they actually want to probe;
    // otherwise this is a destructive test.
    let st = f();
    st == 0 // success means we just thawed an active freeze
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1106Native APImitre ↗