nerdexam
GIAC

GSLC · Question #51

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following reg

The correct answer is A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices. The Windows registry RunServices key is a valid startup execution mechanism that malware can abuse to achieve persistence across reboots.

Security Operations & Incident Response Leadership

Question

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Options

  • AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
  • BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start
  • CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
  • DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

How the community answered

(61 responses)
  • A
    89% (54)
  • B
    3% (2)
  • C
    7% (4)
  • D
    2% (1)

Why each option

The Windows registry RunServices key is a valid startup execution mechanism that malware can abuse to achieve persistence across reboots.

AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesCorrect

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices is a legitimate Windows registry key originally designed to start service-like programs at boot time before user logon, and it is a well-known persistence location abused by Trojans and other malware to survive reboots without requiring full service installation.

BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start is not a valid Windows registry key and does not trigger any program execution at startup.

CHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup is not a valid Windows registry path - the actual startup execution keys use names like 'Run', 'RunOnce', or 'RunServices', not 'Startup'.

DHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto is not a valid Windows registry key and has no startup execution functionality defined by the operating system.

Concept tested: Windows registry run keys as malware persistence mechanisms

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#Windows registry#malware persistence#Trojan#startup keys

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice