A forensic examiner needs to analyze the Windows Registry for persistence mechanisms on a compromised system. Which registry key is most commonly used by malware to achieve persistence on user logon?
Select an answer to reveal the explanation.
Short Explanation
You want the Run key under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run because it launches programs automatically when a user logs on, so malware commonly uses it for persistence. The crash-control key is for dump settings, not startup.
Full Explanation
The correct key is HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and its HKLM equivalent, because programs listed there are executed automatically at user logon, making it one of the most frequently abused registry locations for malware persistence. The CrashControl key under HKLM\SYSTEM\CurrentControlSet\Control is wrong because it manages system crash dump behavior, not startup programs. The HARDWARE\DESCRIPTION\System key under HKLM is wrong because the HARDWARE hive contains hardware detection data and is not writable in the standard way for persistence. The Shell Folders key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer is wrong because it defines paths for special shell directories such as Documents and Desktop, not application startup.