312-49V11 · Question #100
As a malware analyst, you're tasked with scrutinizing a suspicious program on a Windows workstation, particularly focusing on its interactions with system registry files. Monitoring registry…
The correct answer is D. Analyzing registry key modifications. According to the CHFI v11 syllabus under Malware Forensics and System Behavior Analysis, the Windows Registry is one of the most critical sources of forensic evidence when investigating malware activity. Malware frequently interacts with registry keys to achieve persistence…
Question
As a malware analyst, you're tasked with scrutinizing a suspicious program on a Windows workstation, particularly focusing on its interactions with system registry files. Monitoring registry artifacts provides insights into malware behavior, aiding in identifying persistence mechanisms and malicious activities. How do forensic investigators gain insights into malware behavior on Windows systems by monitoring registry artifacts?
Options
- AMonitoring network traffic patterns
- BReviewing browser history logs
- CTracking system file executions
- DAnalyzing registry key modifications
How the community answered
(65 responses)- A15% (10)
- B3% (2)
- C8% (5)
- D74% (48)
Explanation
According to the CHFI v11 syllabus under Malware Forensics and System Behavior Analysis, the Windows Registry is one of the most critical sources of forensic evidence when investigating malware activity. Malware frequently interacts with registry keys to achieve persistence, configure execution parameters, disable security controls, or maintain state information across reboots. By analyzing registry key modifications, forensic investigators can identify how malware embeds itself into the operating system and understand its long-term behavior. Common persistence mechanisms include modifications to registry locations such as Run, RunOnce, Services, Winlogon, and scheduled task-related keys. Changes in these keys can reveal how and when malware is executed, whether it runs at system startup, and which privileges it attempts to obtain. CHFI v11 emphasizes monitoring registry artifacts using tools like Process Monitor, Registry Editor, and registry diff utilities to detect unauthorized additions, deletions, or value changes.
Topics
Community Discussion
No community discussion yet for this question.