CHFI OS and Network Forensics Practice Question
A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKLM\SAM\SAM\Domains\Account\Users
Why it's wrong here
The HKLM\SAM\SAM\Domains\Account\Users key is the registry view of the Security Accounts Manager database, storing local user account metadata, SIDs, and NT/LM password hashes. It contains no AutoRun or command-line values, and its content is unrelated to logon startup programs. While attackers may dump SAM hashes for credential theft, editing this key does not create persistence, and the hive is typically locked against writes even for administrators.
- ✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Why it's wrong here
The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key tracks which applications a user launches through Explorer, storing execution counts and last-run timestamps under GUID subkeys in an encoded format. It is a forensic artifact for user activity, not a mechanism for automatically launching programs at startup. Malware cannot achieve persistence by writing here; instead, it is useful for analysts to discover past execution of suspicious tools. Therefore, while relevant to a forensic timeline, it does not satisfy the question's search for auto-start registry entries.
- ✓
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This HKLM Run key is a critical persistence location: at every user logon, the Winlogon process reads it and launches each listed executable for all accounts, requiring administrative privileges to modify. Values are command lines (e.g., 'C:\malware.exe') that run early in the logon sequence, before the desktop is fully interactive. Because it has system-wide scope, it is a top target for malware persistence and a primary check during a forensic investigation for auto-start mechanisms.
- ✗
HKLM\SYSTEM\CurrentControlSet\Services
Why it's wrong here
The HKLM\SYSTEM\CurrentControlSet\Services key defines Windows services, including their type, start value (e.g., SERVICE_AUTO_START), and ImagePath. Services are started by the Service Control Manager independent of a user logging on, run in session 0, and do not behave like typical shell startup programs. Although malware can abuse services for persistence, this key is not the 'typical user auto-start program' mechanism referenced in the question; it is a separate persistence category that would be examined only if service-based persistence is suspected, not for Run-style logon autostarts.
- ✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This per-user Run key is processed at logon for the currently logged-in user, with each value executed in that user's context after the shell initializes. Unlike its HKLM counterpart, it does not require administrator rights to write, making it a common low-privilege persistence vector for trojans or initial access payloads. Forensic analysts should inspect both this key and the HKLM Run key because malware chooses based on the privilege level available; either can hold the attacker's command line, but this one is restricted to a single account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.