nerdexam
GIAC

GCIH · Question #41

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following…

The correct answer is C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices. To persist a Trojan across reboots, attackers edit specific Windows registry Run keys that execute programs at startup. The RunServices key is a legacy Windows registry entry used to launch services automatically on system boot.

Malware Analysis & Advanced Persistent Threats

Question

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options

  • AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
  • BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto
  • CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
  • DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

How the community answered

(50 responses)
  • A
    4% (2)
  • C
    94% (47)
  • D
    2% (1)

Why each option

To persist a Trojan across reboots, attackers edit specific Windows registry Run keys that execute programs at startup. The RunServices key is a legacy Windows registry entry used to launch services automatically on system boot.

AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup is not a valid registry key used by Windows to launch programs at boot.

BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto is not a recognized Windows registry startup key and does not exist in the standard Windows registry structure.

CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesCorrect

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is a legitimate Windows registry key used to automatically execute programs or services at system startup. Placing a malicious executable path in this key causes it to run each time Windows boots, making it a classic persistence mechanism. This key was widely used in early Windows versions and remains a known location for malware persistence.

DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start is not a valid registry key used for automatic program execution at startup.

Concept tested: Windows registry persistence via RunServices key

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#Windows registry#persistence mechanism#Trojan startup#RunServices

Community Discussion

No community discussion yet for this question.

Full GCIH Practice