Source: Juni_2026_Exams/Advance_Forensics/notes/07-persistence-artifacts.md

🔧 Persistence Artifacts & Malware Indicators

What is Persistence?

Persistence = Making malware survive a reboot

After system restart, malware needs to auto-start. This requires registry entries or scheduled tasks that run automatically.

🎯 Where Malware Hides for Persistence

Category 1: Run Keys (VERY Common)

User-Level Run Key

Registry Path:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Or (from forensic hive):
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

Format:
[Program Name] = [Path to Executable]

Example (suspicious):
"Antivirus" = "C:\Windows\Temp\malware.exe"

System-Level Run Key

Registry Path:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Format:
[Program Name] = [Path to Executable]

Example (suspicious):
"ServiceUpdate" = "C:\Temp\remote_access.exe"

How to find: This is TIER 1 — Always check this

Category 2: RunOnce Keys

RunOnce (Runs Once, Then Deletes)

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Format:
[Name] = [Path]

Note: Runs at next boot, then deletes registry entry
Suspicious if: Points to Temp, hidden, or suspicious program

Category 3: Startup Folder

User Startup Folder

Location:
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Contains:
├── legitimate_app.lnk
└── suspicious_malware.lnk ← Auto-runs on user login

System Startup Folder

Location:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\

Contains:
├── Windows updates.lnk
└── SystemService.lnk ← Runs for all users

What to check:

• Are there .lnk files pointing to suspicious locations?
• Temp folder files?
• Network paths?

Category 4: Services (Advanced Persistence)

System Services

Registry Path:
HKLM\System\CurrentControlSet\Services\[ServiceName]

Key values:
├── ImagePath = Path to executable
├── Start = When it starts (2=automatic)
└── Type = Win32, driver, etc.

Example (suspicious):
Service Name: "VirusUpdate"
ImagePath: "C:\Windows\System32\malware.exe"
Start: 2 (Automatic)

How to find: Check for unknown services, odd executable paths

Category 5: Boot Execute

Session Manager Boot Execute

Registry Path:
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute

What: Programs run DURING BOOT (before Windows fully loads)

This is VERY suspicious
Example: Rootkit or bootkit trying to hide

Category 6: AppInit DLLs (DLL Injection)

AppInit DLLs Injection

Registry Path:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows
Value: AppInit_DLLs

What: DLL loaded into ALL processes automatically

Example:
AppInit_DLLs = "C:\Windows\Temp\injected.dll"

Suspicious: ANY value here is suspicious

Category 7: Browser Helper Objects (BHO)

IE Browser Extensions

Registry Path:
HKLM\Software\Microsoft\Internet Explorer\Extensions
HKCU\Software\Microsoft\Internet Explorer\Extensions

What: Browser plugins/extensions

Suspicious:
├── Unknown publisher
├── Temp folder location
└── Random GUID name

Category 8: Scheduled Tasks

Task Scheduler Persistence

Location:
C:\Windows\System32\Tasks\

Or Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

What: Programs run at specific times

Suspicious:
├── Tasks named after legit Windows components
├── Pointing to Temp/AppData
└── Unusual frequency (every hour, every 5 min)

🔍 How to Identify Persistent Malware

Step 1: Export Registry

Extract from forensic image:
├── SOFTWARE
├── SYSTEM
└── All NTUSER.DAT files

Step 2: Open in Registry Explorer

Load each hive file

Step 3: Check Run Keys

1. Navigate to:
   NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run

2. Read each entry
3. Ask: Is this legitimate?
   ├─ "Adobe Reader" = Probably OK
   ├─ "Antivirus Update" = CHECK - Odd name?
   └─ "CVE202X" = SUSPICIOUS

4. Document suspicious entries

Step 4: Cross-Reference

Check if executable exists at path
Check timestamp (when was it added to Run key?)
Check MFT for file creation date

🚨 Red Flags for Persistence

Red Flag 1: Temp Folder Reference

ANY persistence pointing to:
├─ C:\Temp\
├─ C:\Windows\Temp\
├─ C:\Users\[user]\AppData\Local\Temp\
└─ C:\Users\[user]\AppData\LocalLow\Temp\

Reason: Temporary files often get deleted
Implication: LIKELY MALWARE

Red Flag 2: Unusual Executable Name

Legitimate names:
├─ Adobe Reader Update
├─ Microsoft Office
└─ OneDrive

Suspicious names:
├─ "Antivirus" (but not pointing to Program Files)
├─ "SystemService" (but path is C:\Temp)
├─ "Windows.Defender" (but path looks wrong)
└─ Random strings: "xkLqPmN"

Red Flag 3: Hidden/System Folders

Suspicious paths:
├─ C:\Windows\... (unless Program Files\Windows Defender)
├─ C:\Recovery\...
├─ C:\System Volume Information\...
└─ Any path with $ prefix: C:\$Recycle.Bin\...

Red Flag 4: Network/UNC Path

Persistence pointing to:
\\servername\share\malware.exe

Meaning: Malware loaded from network share
Implication: Possible worm or network propagation

Red Flag 5: Missing Executable

Registry Run key points to: C:\Program Files\Software\app.exe
Reality: File doesn't exist!

Meaning: File was deleted but registry entry remains
Implication: Deleted malware (check MFT for deleted file)

📋 Persistence Audit Checklist

Critical Registry Paths to Check

• [ ] NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
• [ ] Any suspicious programs?
• [ ] Any Temp folder references?

• [ ] NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
• [ ] Any entries?
• [ ] Any suspicious?

• [ ] SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• [ ] System-level persistence?
• [ ] Unknown programs?

• [ ] HKLM\System\CurrentControlSet\Services\
• [ ] Check "Start" values (0=disabled, 2=auto, 3=manual)
• [ ] Any suspicious ImagePath values?

• [ ] Startup folders
• [ ] C:\Users\[user]\...\Start Menu\Programs\Startup\
• [ ] .lnk files pointing to suspicious locations?

🎯 Exam Question Examples

Q: "Where is the malware persistence mechanism?"

Answer format:
1. Found registry entry at: [path]
2. Value name: [name]
3. Points to: [malware path]
4. Timestamp: [when added]
5. Status: ACTIVE

Example:
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
Value: "Windows Update"
Points to: C:\Windows\Temp\malware.exe
Created: 2021-08-09 14:30 UTC
Status: ACTIVE (will run on user login)

Q: "Is this program set to auto-run?"

Answer:
YES - Found in Run registry key pointing to executable
NO - Not found in any persistence mechanism

If YES, document:
- Exact registry path
- Program name
- Executable path
- Timestamp

Q: "What happens if the user restarts their computer?"

Answer:
Based on registry analysis:
1. The following programs will auto-start:
   ├─ [Program 1] from [path]
   ├─ [Program 2] from [path]
   └─ [Program 3] from [path]

2. These include legitimate software AND malware
3. The malware will automatically execute before user can stop it
4. Timeline would be: Boot → System loads → Malware runs

⚠️ Benign vs. Suspicious

Usually Legitimate

Microsoft Office
Adobe Reader
Google Drive Sync
Dropbox
Steam
Discord
Skype
Windows Defender

Usually Suspicious

Files in Temp/AppData/Local/Temp
Random strings as names
Multiple entries by same file
Executable in Windows folder (except System32/Program Files)

Requires Further Investigation

Unknown publisher programs
Programs with similar names to legitimate ones (typosquatting)
Programs without descriptions
System services with unusual paths

💡 Pro Tips

Tip 1: Take Screenshots

Screenshot each suspicious registry entry:
├─ Path
├─ Value name
├─ Executable path
└─ Save date/time

Tip 2: Cross-Reference with Files

Run key says: "C:\Program Files\Software\app.exe"
Check: Does this file actually exist?
├─ YES: When was it created/modified?
└─ NO: Likely deleted malware (check MFT)

Tip 3: Check All Users

Don't just check one user!
├─ Check NTUSER.DAT for each user
├─ Check System-level Run keys
└─ Check common Temp locations

Last Updated: June 15, 2026