Windows Registry Persistence: Run and Services Keys
A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?
Quick Answer
The correct answer is the Run keys under HKCU and HKLM, specifically HKCU\Software\Microsoft\Windows\CurrentVersion\Run, because these registry locations are designed to launch programs automatically each time a user logs on, making them a primary target for malware seeking persistence. Malware authors exploit these keys to ensure their code executes without user intervention, often by adding a value pointing to a malicious executable. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your ability to distinguish between true persistence mechanisms and artifacts like Prefetch files or SAM hive data, which serve different forensic purposes. A common trap is confusing Services keys—while services can provide persistence, they reside under SYSTEM\CurrentControlSet\Services, not as direct "Run" keys, so the question specifically targets the Run and RunOnce paths. Remember the mnemonic "Run for user, Run for machine" to recall that HKCU applies to the current user and HKLM applies to all users, both being classic startup vectors.
⚠ Common exam trap
A common mix-up: candidates confuse registry locations used for user-specific startup (like HKCU\...\Run) with system-wide persistence mechanisms, or they mistakenly think non-startup keys like SAM or ShellBags are relevant to auto-execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKLM\SYSTEM\CurrentControlSet\Services
D is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry key stores configuration for Windows services, including the ImagePath value that specifies the executable to run. Malware often installs as a service to achieve automatic execution at system startup, as services are started by the Service Control Manager (SCM) during boot, independent of user logon.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKLM\SAM
Why it's wrong here
SAM stores local account hashes, not startup items.
- ✗
C:\Windows\Prefetch
Why it's wrong here
Prefetch is a file folder, not a registry key, and does not cause automatic execution.
- ✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags
Why it's wrong here
ShellBags track folder view settings, not startup execution.
- ✓
HKLM\SYSTEM\CurrentControlSet\Services
Why this is correct
Services subkeys can be configured to start automatically, used by malware for persistence.
- ✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This Run key specifies programs that run when the user logs in.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?
medium- A.HKLM\SAM\SAM
- ✓ B.HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- C.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- D.HKLM\SYSTEM\CurrentControlSet\Services
Why B: The 'Run' key at HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the standard registry location used by legitimate software and malware alike to execute a program automatically at every system startup. This key stores values that point to executable paths, and Windows’ Winlogon process reads these values during boot to launch the specified programs. It is a primary persistence mechanism in Windows forensics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.