GCIH · Question #41
You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following…
The correct answer is C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices. To persist a Trojan across reboots, attackers edit specific Windows registry Run keys that execute programs at startup. The RunServices key is a legacy Windows registry entry used to launch services automatically on system boot.
Question
You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?
Options
- AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
- BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto
- CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
- DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start
How the community answered
(50 responses)- A4% (2)
- C94% (47)
- D2% (1)
Why each option
To persist a Trojan across reboots, attackers edit specific Windows registry Run keys that execute programs at startup. The RunServices key is a legacy Windows registry entry used to launch services automatically on system boot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup is not a valid registry key used by Windows to launch programs at boot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto is not a recognized Windows registry startup key and does not exist in the standard Windows registry structure.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is a legitimate Windows registry key used to automatically execute programs or services at system startup. Placing a malicious executable path in this key causes it to run each time Windows boots, making it a classic persistence mechanism. This key was widely used in early Windows versions and remains a known location for malware persistence.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start is not a valid registry key used for automatic program execution at startup.
Concept tested: Windows registry persistence via RunServices key
Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
Topics
Community Discussion
No community discussion yet for this question.