Exam SEC504 topic 1 question 4 discussion

Correct one

The correct registry value associated with the Klez worm is [B]. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run12. This registry entry ensures that the worm runs automatically when Windows starts up. Remember to stay vigilant against such threats and keep your systems updated and secure! https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Klez https://www.allaboutworms.com/worm-klez

Use Run or RunOnce registry keys to make a program run when a user logs on. The Run key makes the program run every time the user logs on, while the RunOnce key makes the program run one time, and then the key is deleted. These keys can be set for the user or the machine. The Windows registry includes the following four Run and RunOnce keys: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Marking B: Researching the klez worm you find the reg key it creates for persistence resembles the below. And B is the closest to the that. HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run Wink{random alphabetic characters} = "%System%\WINK{random alphabetic characters}.EXE"