CHFI Mobile and Malware Forensics — 20 Questions

Question 1

During a mobile forensics investigation, an analyst needs to acquire data from an iPhone that cannot be bypassed via passcode. The device is locked, and the analyst has the passcode. Which acquisition method provides the MOST comprehensive data extraction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical acquisition. Physical acquisition provides the most comprehensive data extraction because it creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. With the passcode known, the analyst could unlock the device and perform logical or file system acquisition, but these methods only capture accessible files and may miss forensic artifacts. Physical acquisition (e.g., via JTAG or chip-off) bypasses the operating system and extracts raw NAND data, yielding the fullest forensic picture.

Answer

Manual acquisition

Answer

Logical acquisition

Answer

File system acquisition

Question 2

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 3

In an Android forensic investigation, an examiner extracts the /data/data/com.whatsapp/databases/msgstore.db file. The database contains a table 'messages' with columns 'key_remote_jid', 'data', and 'timestamp'. Which SQL query would retrieve all messages sent to a specific contact with a phone number ending in '1234'?

Accepted Answer

SELECT * FROM messages WHERE key_remote_jid LIKE '%1234%'. The `key_remote_jid` column stores the remote party's identifier (e.g., a phone number with country code), and the `LIKE '%1234%'` pattern matches any value containing '1234' anywhere in the string. This retrieves all messages where the contact's phone number ends with '1234', as required by the question.

Answer

SELECT * FROM messages WHERE key_remote_jid = '%1234%'

Answer

SELECT * FROM messages WHERE data LIKE '%1234%'

Answer

SELECT * FROM messages WHERE timestamp LIKE '%1234%'

Question 4

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, may persist after a factory reset because they are often stored on a dedicated persistent partition (e.g., /persist or /misc) that is not erased by a standard reset. Forensic tools can recover these identifiers from that partition, providing evidence of prior usage. This is unlike user-generated data such as SMS, Wi-Fi passwords, or app logs, which reside in the /data partition and are typically wiped.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 5

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 6

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 7

During dynamic analysis of a malware sample, an analyst uses Process Monitor to capture registry and file system activity. Which filter would be MOST effective in identifying attempts to create a persistence mechanism?

Accepted Answer

Filter for 'RegSetValue' events with path containing 'CurrentVersion\Run'. The 'CurrentVersion\Run' registry key is a standard persistence location where malware adds entries to execute automatically at user logon. Filtering for 'RegSetValue' events targeting this path directly captures the act of writing a new value to that key, which is a common persistence mechanism. Process Monitor's 'RegSetValue' operation specifically monitors registry value modifications, making it the most effective filter for this purpose.

Answer

Filter for 'WriteFile' events in System32

Answer

Filter for 'Process Create' events

Answer

Filter for 'RegSetValue' events with path containing 'RunOnce'

Question 8

An iOS forensic analyst extracts the Keychain from an iTunes backup. Within the Keychain, they find an entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud'. What type of data does this entry MOST likely contain?

Accepted Answer

iCloud credentials. The entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud' corresponds to the iCloud credentials stored in the iOS Keychain. The service identifier 'com.apple.sbd' is the bundle ID for Apple's 'sbd' daemon, which handles iCloud syncing and authentication. This Keychain entry stores the user's iCloud account password, not a Wi-Fi password, device passcode, or SMS encryption key.

Answer

Wi-Fi password

Answer

Device passcode

Answer

SMS encryption key

Question 9

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Accepted Answer

Process injection. SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

Answer

Persistence through service

Answer

Anti-debugging

Answer

Network sniffing

Question 10

A forensic examiner is analyzing a mobile device that may have been tampered with to erase evidence. Which TWO anti-forensic techniques are commonly encountered in mobile forensics? (Select TWO.)

Accepted Answer

Factory reset. Factory reset (option C) is a common anti-forensic technique in mobile forensics because it wipes user data partitions and resets the device to its original state, often using the 'wipe_data' command in recovery mode or via settings. This removes user-installed applications, accounts, and files, making data recovery difficult unless a physical or chip-off method is used. Timestomping (option E) is also common, as attackers modify file timestamps (e.g., using 'touch -t' on rooted devices or manipulating EXT4 metadata) to mislead forensic timelines and hide the sequence of events.

Answer

Encryption

Answer

Steganography

Answer

Log wiping

Question 11

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Accepted Answer

The IP address 185.10.68.12. The IP address 185.10.68.12 on port 443 is the best immediate indicator of compromise (IoC) because it is a network-based artifact that can be directly blocked at the firewall or monitored for outbound connections. Network-based IoCs are often prioritized in threat intelligence sharing because they enable proactive perimeter defense and are actionable across multiple systems, unlike host-based artifacts (mutexes, registry keys) that require endpoint-level detection. Additionally, the IP address is independent of file hashes and can be used to detect or block communications even when the malware binary changes.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 12

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Accepted Answer

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Answer

Making outbound TCP connections to an IP address

Answer

Creating a named mutex

Answer

Creating files in the %TEMP% directory

Question 13

An iOS forensic analyst is examining data from an iCloud backup and finds a file named 'call_history.db'. Which SQLite table within this database is MOST likely to contain the duration and timestamp of each phone call?

Accepted Answer

call. In iOS, call history data is stored in the 'call_history.db' SQLite database, and the primary table containing call duration and timestamps is named 'call'. The 'call' table includes columns such as 'duration' (in seconds) and 'date' (as a Cocoa Core Data timestamp). This is the standard schema used by Apple's Phone app since iOS 4.

Answer

ZCONTACT

Answer

ZOBJECT

Answer

ZCALL

Question 14

Which of the following is a key difference between static analysis and dynamic analysis in malware forensics?

Accepted Answer

Static analyzes the code without execution; dynamic executes the malware.. Static analysis involves examining the malware's code (e.g., disassembly, string extraction, hash analysis) without executing it, while dynamic analysis runs the malware in a controlled sandbox environment to observe its runtime behavior, such as file system changes, registry modifications, and network connections. This fundamental distinction is critical in malware forensics to safely understand the threat without risking infection.

Answer

Static analysis requires the malware to be executed, while dynamic analysis does not.

Answer

Static analysis is used only for packed malware, while dynamic analysis is used for unpacked.

Answer

Dynamic analysis uses tools like IDA Pro, while static uses Cuckoo Sandbox.

Question 15

A security analyst notices that a compromised Android device's /data/data/com.example.app/databases/ directory contains a database with tables named 'accounts', 'transactions', and 'settings'. Which type of forensic acquisition would be MOST appropriate to capture this app-specific data while preserving deleted records?

Accepted Answer

Physical extraction. Physical extraction creates a bit-for-bit copy of the entire flash memory, including unallocated space and deleted SQLite records that have not been overwritten. This is the only method that can recover deleted rows from the 'accounts', 'transactions', and 'settings' tables because logical and file-system extractions typically skip unallocated blocks. The /data/data/com.example.app/databases/ directory is protected by Android's sandboxing, but physical acquisition bypasses the OS and reads the raw NAND or eMMC blocks directly.

Answer

File system extraction

Answer

Logical extraction via ADB

Answer

Manual extraction via device UI

Question 16

A malware analyst is examining a PE file that has a section named '.tls' and imports from 'kernel32.dll' and 'ntdll.dll'. The entry point points to a small stub that decrypts the main code at runtime. Which of the following best describes this technique?

Accepted Answer

TLS callback-based decryption. The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

Answer

Code injection via Reflective DLL

Answer

Packing with UPX

Answer

Anti-debugging via NtGlobalFlag

Question 17

Which of the following mobile forensics tools is specifically designed to extract data from iOS devices by exploiting the device's bootrom vulnerability (e.g., checkm8) to perform a physical extraction?

Accepted Answer

Cellebrite UFED. Cellebrite UFED is a mobile forensic tool that supports physical extraction from iOS devices by exploiting the checkm8 bootrom vulnerability (A5–A11 chips), enabling full file system acquisition without a passcode. GrayKey is an iOS-specific password bypass device that does not rely on a bootrom vulnerability as its primary method.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

GrayKey

Question 18

During dynamic analysis of a malware sample in Any.run, an analyst observes that the malware writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and also creates a scheduled task named 'UpdateTask'. Which anti-forensic technique is the malware MOST likely attempting to counter?

Accepted Answer

Log wiping. The malware creates persistence by adding a Run key and a scheduled task, ensuring it executes automatically upon system startup or at scheduled times. This persistence mechanism allows the malware to survive log wiping attempts (a common anti-forensic technique) because even if forensic analysts clear log files to remove evidence, the malware will run again and re-generate logs or continue its malicious activities, thereby countering the anti-forensic technique of log wiping.

Answer

Packing

Answer

Encryption

Answer

Timestomping

Question 19

A mobile forensic examiner is analyzing an Android device that has been factory reset. Which TWO of the following artefacts are MOST likely to still be recoverable after a factory reset? (Select TWO)

Accepted Answer

SMS messages. SMS messages (A) are stored in the Android internal database file `/data/data/com.android.providers.telephony/databases/mmssms.db`. A factory reset typically only marks the database file's storage blocks as free in the ext4 filesystem without performing a secure wipe, leaving the raw data recoverable via forensic tools like Cellebrite or Oxygen Forensic until overwritten. Google account tokens (D) are stored in the AccountManager service's SQLite database under `/data/system/users/0/accounts.db` and in the `authtoken` table; even after a factory reset, the underlying NAND flash memory may retain these tokens due to wear-leveling and garbage collection delays, allowing recovery with chip-off or JTAG techniques.

Answer

Deleted applications' data

Answer

Call logs

Answer

Photos stored in internal storage

Question 20

A malware analyst is analyzing a suspicious executable. Which THREE of the following are valid indicators of compromise (IoCs) that can be extracted from static analysis of the PE file? (Select THREE)

Accepted Answer

IP addresses from embedded strings. Static analysis of a PE file involves examining the file without executing it. Embedded strings, such as IP addresses, can be extracted using tools like `strings` or `binwalk` and serve as IoCs indicating command-and-control servers or other network destinations. These strings are stored in the PE file's data sections and are directly observable in the binary.

Answer

Registry keys modified during execution

Answer

File paths created during execution