Tags: forensics memorydump volatility darkcomet
Rating:
# Attaaaaack10
## Background
Q10. we think that the malware uses persistence technique can you detect it ?
example : crew{Scheduled_tasks} (first letter of the first word is uppercase and the first letter of other is lowercase)
Author : 0xSh3rl0ck
## Find the flag
**In the [blog](http://www.tekdefense.com/news/tag/malware-analysis) that we've found in Attaaaaack9, the DarkComet malware has a persistence mechanism:**
With that said, the persistence mechanism is modifying the registry key, so that everytime when the victim logged in, it'll run `runddl32.exe`.
- **Flag: `crew{Registry_keys}`**
