Windows Registry Persistence: Run and Services Keys
A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?
Quick Answer
The correct answer is the Run keys under HKCU and HKLM, specifically HKCU\Software\Microsoft\Windows\CurrentVersion\Run, because these registry locations are designed to launch programs automatically each time a user logs on, making them a primary target for malware seeking persistence. Malware authors exploit these keys to ensure their code executes without user intervention, often by adding a value pointing to a malicious executable. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your ability to distinguish between true persistence mechanisms and artifacts like Prefetch files or SAM hive data, which serve different forensic purposes. A common trap is confusing Services keys—while services can provide persistence, they reside under SYSTEM\CurrentControlSet\Services, not as direct "Run" keys, so the question specifically targets the Run and RunOnce paths. Remember the mnemonic "Run for user, Run for machine" to recall that HKCU applies to the current user and HKLM applies to all users, both being classic startup vectors.
⚠ Common exam trap
A common mix-up: candidates confuse registry locations used for user-specific startup (like HKCU\...\Run) with system-wide persistence mechanisms, or they mistakenly think non-startup keys like SAM or ShellBags are relevant to auto-execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKLM\SYSTEM\CurrentControlSet\Services
Option D, HKLM\SYSTEM\CurrentControlSet\Services, is correct because this registry hive stores service configurations, including the Start value that determines whether a service (or malicious driver/service) launches automatically at boot, making it a classic autostart persistence location. Option E, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key causes listed programs to execute automatically when that user logs on, a very common malware persistence mechanism. Option A, HKLM\SAM, is not an autostart location; it stores local account and security database information. Option B, C:\Windows\Prefetch, is a filesystem artifact used for execution evidence and performance, not a registry startup key. Option C, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags, records folder view settings and is useful for user activity forensics, not automatic execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKLM\SAM
Why it's wrong here
HKLM\SAM stores local account and group data plus password hashes, not autostart entries, so it cannot reveal startup persistence. It is tempting because it is a high-value forensic hive, but its contents are credentials rather than execution triggers. Persistence lives in Run, RunOnce and similar autorun keys.
- ✗
C:\Windows\Prefetch
Why it's wrong here
Prefetch holds execution traces used to prove a binary ran, not autostart configuration, so it cannot show startup persistence. Investigators value it for timeline and evidence of execution, which makes it tempting here. The Run and RunOnce keys are the registry locations that actually launch programs automatically at logon or boot.
- ✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags
Why it's wrong here
ShellBags record folder view settings and window positions per user, providing evidence of accessed directories, not automatic execution. They are tempting because they sit under a CurrentVersion path resembling autorun keys. Persistence instead uses Run, RunOnce or equivalent startup entries that launch processes at logon or boot.
- ✓
HKLM\SYSTEM\CurrentControlSet\Services
Why this is correct
HKLM\SYSTEM\CurrentControlSet\Services satisfies the persistence requirement because Windows loads service entries here at boot via the Service Control Manager, before user logon. Malware registers a malicious driver or service to achieve SYSTEM-level autostart, making this a core location for forensic examination of startup persistence.
- ✓
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
The HKCU Run key executes programs under the logged-on user's context at each interactive sign-in, requiring no elevation. Malware placed here persists per-user, satisfying the scenario's need for a common autostart location alongside its HKLM counterpart.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst is examining a Windows system for evidence of a program that runs automatically every time the system starts. Which registry key is commonly used to achieve persistence via the 'Run' key?
medium- A.HKLM\SAM\SAM
- ✓ B.HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- C.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- D.HKLM\SYSTEM\CurrentControlSet\Services
Why B: The 'Run' key at HKLM\Software\Microsoft\Windows\CurrentVersion\Run is the standard registry location used by legitimate software and malware alike to execute a program automatically at every system startup. This key stores values that point to executable paths, and Windows’ Winlogon process reads these values during boot to launch the specified programs. It is a primary persistence mechanism in Windows forensics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.