nerdexam
GIAC

GCFA · Question #259

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries…

The correct answer is C. HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file". The Klez worm can be identified by the registry key that points to the Windows Address Book (WAB) file, which the worm reads to harvest victim email addresses.

File System & Registry Forensics

Question

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows Address Book (WAB). Which of the following registry values can be used to identify this worm?

Options

  • AHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • BHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
  • CHKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"
  • DHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

How the community answered

(51 responses)
  • A
    8% (4)
  • B
    16% (8)
  • C
    73% (37)
  • D
    4% (2)

Why each option

The Klez worm can be identified by the registry key that points to the Windows Address Book (WAB) file, which the worm reads to harvest victim email addresses.

AHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a persistence key used to launch programs at user login and is not specific to Klez's WAB file harvesting behavior.

BHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices is used to start services at boot and is not related to the Windows Address Book access that distinguishes the Klez worm.

CHKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"Correct

HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name stores the path to the Windows Address Book file that Klez specifically targets to collect email addresses for mass-mailing. Inspecting this key reveals the WAB file location the worm accessed, making it a forensic indicator directly tied to the worm's email-harvesting behavior rather than its persistence mechanism.

DHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is another startup persistence location and does not identify the Klez worm's specific technique of reading the WAB for email addresses.

Concept tested: Klez worm WAB registry key identification

Source: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-020

Topics

#Klez worm#registry forensics#malware artifacts#Windows Address Book

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice