200-201 Question 306
Single answerWhile investigating a potential malware infection on a Windows server, a cybersecurity analyst notices an unknown process running with a high privilege level. The analyst checks the associated registry keys and observes a suspicious entry in the 'Run' key under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. What is the significance of this registry key, and what action should the analyst take next?
- A
The registry key is used for temporarily storing malware scripts, and the analyst should delete it immediately.
- B
The registry key is commonly used by Windows to execute programs at startup, and the analyst should investigate the associated process further.
- C
The registry key is used for system updates, so the analyst should ignore the finding.
- D
The registry key is for managing user permissions, and the analyst should analyze user account activity instead.
Show answer and explanation
Correct answer: B
Explanation
The 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' registry key is a common persistence mechanism used by both legitimate software and malware to execute programs at startup. When an unknown or suspicious process is linked to this registry key, the analyst should investigate further to determine if it is malicious. This may involve analyzing the process, checking its file location, and reviewing its digital signature.
- A. Incorrect.
This is incorrect because the 'Run' registry key is not used for temporarily storing scripts. Deleting it immediately without further investigation could destroy evidence or cause system instability.
- B. Correct.
This is correct because the 'Run' registry key is a legitimate location where programs are configured to execute at system startup. If an unknown or suspicious process is associated with it, further investigation is warranted to determine whether it is malicious.
- C. Incorrect.
This is incorrect because the 'Run' registry key is not related to system updates. Ignoring the finding could allow the malware to persist on the system.
- D. Incorrect.
This is incorrect because the 'Run' registry key does not manage user permissions. While analyzing user activity might be useful in some cases, it is not the appropriate action in this scenario.