RunMRU

The RunMRU (Run Most Recently Used) registry key tracks commands entered via the Windows Run dialog box (Win + R). RunMRU provides direct evidence of commands a user manually typed and executed. This makes it relevant for insider threat cases and social engineering investigations, including ClickFix-style attacks that trick users into pasting malicious commands into the Run box.

Location

Dead Analysis (Offline):

Registry File: C:\Users\<username>\NTUSER.DAT
Key: Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Live Analysis:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

RunMRU is per-user. Each user account on the system maintains its own independent RunMRU key within their NTUSER.DAT hive.

Structure and Interpretation

The RunMRU key contains individual values and an ordering value:

Lettered Values (a, b, c, ... z): Each value stores a command string that was executed. Letters are assigned sequentially as new unique commands are entered. a is the first command ever entered, b the second, and so on. Each stored command has \1 appended to it (e.g., cmd\1, regedit\1).
MRUList: This value tracks the order of use, not the order of creation. The leftmost character in MRUList represents the most recently used command. For example, an MRUList of cab means value c was used most recently, then a, then b.
Maximum Entries: 26 entries (a-z). Once all 26 slots are used, the next new command overwrites the least recently used entry's value name. If a duplicate command is entered, no new value is created. Instead, the existing entry's position is updated in MRUList.
Invalid Commands: If the user enters something invalid (e.g., a file path that doesn't exist), it will not be recorded.

Important Distinction

The letter assigned to a value does not indicate recency. A common misconception is that a is always the most recent. In reality, a is simply the first command that was ever entered. The MRUList value is the authoritative source for execution order.

Forensic Value

RunMRU can provide:

The user account that executed the command (derived from which NTUSER.DAT hive contains the entry).
The exact command string as the user typed it.
Relative execution order via the MRUList value.
Last execution timestamp from the registry key's Last Write Time, which reflects when the most recent command was entered. Individual commands do not have their own timestamps.

Limitations

Limited scope: Only commands entered through the Run dialog box are recorded. Commands run via cmd.exe, PowerShell, Task Scheduler, or any other method are not captured here.
Limited history: Maximum of 26 entries per user.
No per-entry timestamps: Only the key's Last Write Time is available, which reflects only the most recent command entry.
Easily cleared: An attacker can delete the RunMRU key or individual values. Disabling the "Let Windows improve Start and search results by tracking app launches" privacy setting also stops RunMRU from recording and deletes existing history.

Ways the Run Dialog Can Be Invoked

The Run dialog is implemented in shell32.dll and can be triggered in multiple ways, all of which use the same underlying RunMRU key:

Win + R
Windows Start Menu Search > "Run"
Task Manager > "Run new task"
Shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} (Shell CLSID)
rundll32.exe shell32.dll,#61 (calling the export directly)
Programmatically via Shell.FileRun() or IShellDispatch.FileRun()

Modern Relevance: ClickFix and Fake CAPTCHA Attacks

RunMRU has gained renewed forensic importance due to ClickFix/FakeCAPTCHA campaigns. These attacks use social engineering to trick users into opening the Run dialog and pasting a malicious command (typically a PowerShell download cradle) that was silently placed on their clipboard. Because the command passes through the Run box, it gets recorded in RunMRU. This makes the artifact a potential indicator of compromise for these campaigns. Look for RunMRU entries containing powershell, mshta, cmd /c, or encoded command strings.

Artifact Correlation

RunMRU should be correlated with other execution artifacts to build a more complete timeline:

Prefetch: Confirms whether the program referenced in RunMRU was actually executed and provides execution timestamps.
BAM/DAM: Background/Desktop Activity Moderator entries may corroborate execution with timestamps.
Amcache: May record the executable's SHA1 hash and metadata.
ShimCache: Confirms file presence on the system (not execution on Windows 10/11).
UserAssist: Tracks GUI program execution with run counts and timestamps. May overlap with Run box usage.
Windows Event Logs: Sysmon Event ID 1 (Process Create) or Security Event ID 4688 (Process Creation) can provide the full process command line with timestamps.

Tools for Analysis

Registry Explorer (Eric Zimmerman): Browse and analyze the RunMRU key structure directly from offline NTUSER.DAT hives.
RegRipper: The runmru plugin automatically parses and presents RunMRU data in chronological order.
Autopsy: Parses RunMRU as part of its Recent Activity module.
Cyber Triage: Normalizes RunMRU data alongside other execution artifacts into a unified process view.
KAPE: Can target and collect NTUSER.DAT hives for offline analysis. Combine with RegRipper or Registry Explorer for parsing.

Anti-Forensics Considerations

Key deletion: Attackers can delete the RunMRU key entirely or remove individual values.
Privacy setting: The Windows privacy setting "Let Windows improve Start and search results by tracking app launches" (Start_TrackProgs registry value) can be toggled off, which stops RunMRU recording and deletes the existing key.
ACL modification: Setting a Deny All ACL on the RunMRU key prevents Explorer from reading or writing to it, effectively disabling the artifact while the Run dialog still functions.
Selective deletion: Removing individual lettered values removes those commands from the Run dialog history, though the MRUList value may still reference the deleted letter until the next command is entered.

References

PreviousLast Visited MRU NextMUI Cache

Last updated 2 months ago