CHFI OS and Network Forensics Practice Question

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

⚠ Common exam trap

Many exam-takers confuse the Run key with the Services key (Option B), thinking that any service can achieve per-user logon persistence, but services run under the SYSTEM account and are not triggered by user logon unless specifically configured with a trigger-start service or by setting the service to 'Automatic' and relying on delayed start, which is not the standard per-user logon mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HKLM\SAM\SAM
Why it's wrong here
The SAM hive stores local user account credentials, not startup programs; malware persistence via logon requires a Run or RunOnce key under either HKLM\Software\Microsoft\Windows\CurrentVersion or HKCU\Software\Microsoft\Windows\CurrentVersion. This option tempts because SAM is a high-value target for credential theft, making it correct in a password-dumping scenario, but it lacks any subkey that triggers executable execution at user logon.
✗
HKLM\SYSTEM\CurrentControlSet\Services
Why it's wrong here
HKLM\SYSTEM\CurrentControlSet\Services enumerates service objects managed by the Service Control Manager, not per-user logon startup commands. Each service has a Start value (e.g., 0x2 for auto-start) and an ImagePath, but execution is initiated by the SCM at boot or when the service is demanded, not by the user logon shell. Although malware persistence is often accomplished by creating a driver or service here, that is a system-wide mechanism and is not the registry Run key that Windows processes at user logon.
✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
This is the canonical per-user Autorun key: when the user logs in, Winlogon/Explorer enumerates values under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and launches each command line, making it the exact location an investigator should inspect for a user-specific startup program. The HKCU hive is loaded from the user's NTUSER.DAT, so findings here are tied to a single profile. Because the question asks about a Windows 10 user logon startup, this key is the correct answer.
✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
Why it's wrong here
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall is not processed at logon; it is the registry backing for 'Apps & features' and enumerates installed programs with metadata such as DisplayName and UninstallString. The UninstallString is only invoked when the user manually chooses to remove the application, so the key never causes automatic code execution at sign-in. It is easy to mistake for a Run key because of the adjacent CurrentVersion path, but its purpose is maintenance, not persistence.

Go deeper

CHFI OS and Network Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question