GPEN · Question #289
You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following…
The correct answer is D. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices. Windows registry contains specific keys that control which programs run at startup; the RunServices key enables programs and services to execute automatically on each boot.
Question
You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?
Options
- AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start
- BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto
- CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
- DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
How the community answered
(47 responses)- A2% (1)
- B4% (2)
- C9% (4)
- D85% (40)
Why each option
Windows registry contains specific keys that control which programs run at startup; the RunServices key enables programs and services to execute automatically on each boot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start is not a valid Windows registry key and has no role in startup program execution.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto is not a recognized Windows registry path for autorun or persistence.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup does not exist as a registry key - the Startup folder for shortcuts is a filesystem path, not a registry entry under this hierarchy.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is a recognized Windows registry key used to register programs and services that execute automatically at system startup, before user logon. Trojans and other malware commonly use this key as a persistence mechanism because entries survive reboots and run with system-level timing. This makes it a classic target for both attackers establishing persistence and defenders auditing autorun locations.
Concept tested: Windows registry autorun persistence keys
Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
Topics
Community Discussion
No community discussion yet for this question.