Learning Malware Analysis

2.1 Running the Registry Key

One of the most common persistence mechanisms used by adversaries to survive the reboot is achieved by adding an entry to the run registry keys. The program that is added to the run registry key gets executed at system startup. The following is a list of the most commonly run registry keys. Malware can add itself to various auto-start locations in addition to the ones were are about to mention. The best way to get an idea of various auto-start locations is to use the AutoRuns utility by Sysinternals (https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns):

HKCU\Software\Microsoft\Windows\CurrentVersion\RunHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ...