A forensic examiner needs to analyze the Windows Registry for persistence mechanisms on a compromised system. Which registry key is most commonly used by malware to achieve persistence on user logon?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and its HKLM equivalent) causes specified programs to execute automatically on user logon, making it the most frequently abused registry key for malware persistence. A is wrong because CrashControl settings manage system crash dump behavior, not startup programs.
Full explanation below image
Full Explanation
B is correct because HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and its HKLM equivalent) causes specified programs to execute automatically on user logon, making it the most frequently abused registry key for malware persistence. A is wrong because CrashControl settings manage system crash dump behavior, not startup programs. C is wrong because the HARDWARE hive contains hardware detection data and is not writable in the standard way for persistence. D is wrong because Shell Folders defines paths for special shell directories (Documents, Desktop, etc.), not application startup.