nerdexam
GIAC

GSLC · Question #285

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following…

The correct answer is A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices. This question tests knowledge of Windows registry autostart locations used to achieve program persistence across reboots.

Security Operations & Incident Response Leadership

Question

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options

  • AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
  • BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto
  • CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
  • DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

How the community answered

(24 responses)
  • A
    92% (22)
  • C
    4% (1)
  • D
    4% (1)

Why each option

This question tests knowledge of Windows registry autostart locations used to achieve program persistence across reboots.

AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesCorrect

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is a valid Windows registry key that causes programs to execute automatically at system startup, making it a well-known persistence location used by malware. Programs listed under this key are launched each time Windows boots, before user logon, which ensures the payload runs reliably on every reboot.

BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

There is no standard 'Auto' subkey under CurrentVersion in the Windows registry used for startup execution - this key does not exist as an autorun location.

CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup

'Startup' is not a valid registry subkey under CurrentVersion for autorun; the correct keys are 'Run' and 'RunServices', while the Startup folder is a separate filesystem-based persistence mechanism.

DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

'Start' is not a recognized Windows registry subkey under CurrentVersion for executing programs at boot and does not function as an autorun location.

Concept tested: Windows registry Run key persistence mechanisms

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#trojan persistence#Windows registry#malware#startup programs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice