CHFI Mobile and Malware Forensics Practice Test 4 — 15 Questions

Question 1

During a malware investigation, an analyst examines a suspicious file that appears to have been timestomped. Which THREE of the following techniques or tools can be used to detect timestamp manipulation on Windows?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examining the file’s $STANDARD_INFORMATION vs $FILE_NAME timestamps using tools like MFT2CSV. Option A is correct because on NTFS every file has both $STANDARD_INFORMATION and $FILE_NAME attributes in its MFT record, and timestomping tools typically modify only the $STANDARD_INFORMATION timestamps while leaving $FILE_NAME timestamps intact, so tools like MFT2CSV (or analyzeMFT) that parse and compare both attribute sets can reveal the discrepancy. Option D is correct because the Timestomp tool (from the Metasploit framework) can both modify and display a file's timestamp attributes, allowing an analyst to inspect the MAC(b) timestamps and detect anomalies such as timestamps that predate the file's creation or are inconsistent with other metadata. Option E is correct because the NTFS USN journal ($UsnJrnl:$J) records file system change events with USN numbers and timestamps, so comparing USN journal entries against the file's reported timestamps can expose manipulation where the recorded change time does not match the displayed timestamp. Option B is not correct because Wireshark captures network traffic and cannot inspect local NTFS file metadata or timestamps. Option C is not correct because Regshot compares registry snapshots and does not analyze file system timestamps.

Answer

Capturing network traffic with Wireshark

Answer

Using Regshot to compare registry snapshots

Question 2

A malware sample creates the following registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MalwareName. Which THREE of the following are appropriate next steps for the analyst?

Accepted Answer

Document the registry key as an IoC for future detection. Option B is correct because the exact registry path HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MalwareName is a concrete artifact that can be recorded as an Indicator of Compromise (IoC) and used in future detection rules such as YARA, Sigma, or EDR queries. Option C is correct because malware commonly establishes redundant persistence, so the analyst should also inspect the other Run keys (HKCU\...\Run, HKLM\...\RunOnce, HKLM\...\Wow6432Node\...\Run) and scheduled tasks (schtasks /query) to find related mechanisms. Option D is correct because deleting the malicious value under the Run key removes that specific autostart persistence so the malware no longer launches at user logon. Option A is not among the marked correct answers, and option E is not appropriate as an immediate analyst step since law enforcement contact depends on organizational policy and incident severity, not on a single registry key.

Answer

Run a full system antivirus scan

Answer

Contact law enforcement immediately

Question 3

A forensic examiner is analyzing an iOS device that is locked with a passcode. The examiner has a warrant and needs to acquire the most data possible without altering the device. The device is an iPhone 12 running iOS 15. Which acquisition method is MOST appropriate to obtain a full file system image?

Accepted Answer

Use a GrayKey or Cellebrite Premium with a full file system extraction capability.. For a locked iPhone 12 running iOS 15, a full file system extraction requires specialized tools like GrayKey or Cellebrite Premium that can bypass the passcode on supported versions. These tools are the only viable option to obtain a comprehensive image without altering the device. iTunes backups and iCloud backups are limited and do not provide full file system data. The checkm8 exploit is incompatible with the A14 chip.

Answer

Perform an iTunes backup using the examiner's forensic workstation.

Answer

Use the checkm8 exploit to jailbreak the device and then run a forensic tool.

Answer

Extract the data via iCloud backup from the suspect's Apple ID.

Question 4

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 5

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Accepted Answer

PEiD. PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Answer

Strings

Answer

Ghidra

Answer

IDA Pro

Question 6

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, may persist after a factory reset because they are often stored on a dedicated persistent partition (e.g., /persist or /misc) that is not erased by a standard reset. Forensic tools can recover these identifiers from that partition, providing evidence of prior usage. This is unlike user-generated data such as SMS, Wi-Fi passwords, or app logs, which reside in the /data partition and are typically wiped.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 7

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 8

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 9

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Accepted Answer

GrayKey. GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

Cellebrite UFED

Question 10

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Accepted Answer

Process injection. SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

Answer

Persistence through service

Answer

Anti-debugging

Answer

Network sniffing

Question 11

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 12

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)

Question 13

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 14

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Accepted Answer

The IP address 185.10.68.12. The IP address 185.10.68.12 on port 443 is the best immediate indicator of compromise (IoC) because it is a network-based artifact that can be directly blocked at the firewall or monitored for outbound connections. Network-based IoCs are often prioritized in threat intelligence sharing because they enable proactive perimeter defense and are actionable across multiple systems, unlike host-based artifacts (mutexes, registry keys) that require endpoint-level detection. Additionally, the IP address is independent of file hashes and can be used to detect or block communications even when the malware binary changes.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 15

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Accepted Answer

Physical extraction using a JTAG or chip-off technique. Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Answer

Manual extraction through the user interface

Answer

Logical extraction via ADB

Answer

File system extraction