312-49V11 · Question #135
During a malware forensic investigation, a newly added entry was identified in the Windows AutoStart registry keys after a malware execution on a compromised system. The entry indicates a VB script…
The correct answer is C. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU...\Run key is a common per-user persistence location that triggers programs/scripts at user logon. Since the question specifies it was installed in the Run key to execute upon user login and implies per-user context, HKCU is the expected hive path.
Question
During a malware forensic investigation, a newly added entry was identified in the Windows AutoStart registry keys after a malware execution on a compromised system. The entry indicates a VB script file named "CaoClboog.vbs" installed in the 'Run' key to achieve persistence and run automatically upon user login. As a Computer Hacking Forensic Investigator (CHFI), where would you expect to find this suspicious entry in the registry hive?
Options
- AHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell
- BHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- CHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- DHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,
How the community answered
(33 responses)- A6% (2)
- B12% (4)
- C76% (25)
- D6% (2)
Explanation
The HKCU...\Run key is a common per-user persistence location that triggers programs/scripts at user logon. Since the question specifies it was installed in the Run key to execute upon user login and implies per-user context, HKCU is the expected hive path.
Topics
Community Discussion
No community discussion yet for this question.