Persistence

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

We're noticing some strange connections from a critical PC that can't be replaced. We've run an AV scan to delete the malicious files and rebooted the box, but the connections get re-established. We've taken a backup of some critical system files, can you help us figure out what's going on?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Check the type of extracted file.

3. Since it's a registry file, let's open the file with Registry Viewer.

4. I did a small outsouce about Persistence - Registry Run Kes and found out that the key must be stored inside these paths.

5. Now let's open software.

6. Check inside microsoft.

7. Let's jump to windows.

8. Jump to currentVersion and choose run.

9. Looks like the flag is encoded in base64. Let's decode it.

10. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.