A forensic examiner needs to analyze the Windows Registry for persistence mechanisms on a compromised system. Which registry key is most commonly used by malware to achieve persistence on user logon?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and its HKLM equivalent) causes specified programs to execute automatically on user logon, making it the most frequently abused registry key for malware persistence. A is wrong because CrashControl settings manage system crash dump behavior, not startup programs.
Full Explanation
B is correct because HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and its HKLM equivalent) causes specified programs to execute automatically on user logon, making it the most frequently abused registry key for malware persistence. A is wrong because CrashControl settings manage system crash dump behavior, not startup programs. C is wrong because the HARDWARE hive contains hardware detection data and is not writable in the standard way for persistence. D is wrong because Shell Folders defines paths for special shell directories (Documents, Desktop, etc.), not application startup.