CHFI Mobile and Malware Forensics Practice Question
During a malware analysis, an analyst runs a suspicious executable in a Cuckoo Sandbox and observes that the process creates a mutex named 'Global\XPSS-1.0.0' and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What do these actions MOST likely indicate?
⚠ Common exam trap
EC-Council often tests the distinction between persistence mechanisms and hiding techniques, trapping candidates who confuse a standard persistence location (Run key) with a stealth or concealment method, when hiding typically involves alternate data streams, registry run keys under Policies, or rootkit-level hooks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The malware is establishing persistence and ensuring only one instance of itself runs.
The mutex 'Global\XPSS-1.0.0' is used to prevent multiple instances of the malware from running simultaneously, which is a common anti-analysis and stability technique. Writing a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard method for achieving persistence, ensuring the malware executes automatically at user logon. Together, these actions directly indicate persistence and single-instance control, not privilege escalation, C2 communication, or hiding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The malware is performing privilege escalation by exploiting a known vulnerability.
Why it's wrong here
The observed artifacts—a named mutex and a Run registry key—are characteristic of malware that wants to survive reboots and avoid concurrent execution. They do not provide any evidence of a vulnerability being exploited; privilege escalation typically manifests as process injection, token impersonation, or exploitation of a software flaw, none of which are indicated by these persistence mechanisms.
- ✗
The malware is communicating with a command-and-control server to receive further instructions.
Why it's wrong here
A mutex and a Run key operate entirely within the local system; they do not generate network traffic or establish outbound connections. Command-and-control communication would be detected by network monitoring (e.g., suspicious beacons, TLS handshakes, DNS tunnels), not by file-system or registry artifacts. While the malware may later phone home, these specific artifacts do not directly indicate C2 activity.
- ✗
The malware is attempting to hide its presence by using a system mutex name and a legitimate registry location.
Why it's wrong here
Although naming a mutex after a legitimate system object and placing a value in a standard Run key can help the malware blend in, these actions are not primarily designed to conceal its presence. The Run key ensures the malware launches at user logon, while the mutex prevents multiple copies from running simultaneously—both are operational behaviors, not obfuscation. Hiding would involve file attributes, rootkit techniques, or encryption, which are not indicated here.
- ✓
The malware is establishing persistence and ensuring only one instance of itself runs.
Why this is correct
The Run registry key is a standard persistence mechanism that causes the malware to execute automatically every time the user logs on, ensuring it survives reboots. The named mutex provides a global lock that prevents multiple instances of the malware from running concurrently, which is crucial for avoiding detection through duplicate processes and for maintaining stable infection. Together, these artifacts conclusively indicate the malware's goal of persistent residency and single-instance control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.