Forensic Investigation And Malware Analysis

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

During malware analysis, a SOC analyst observes that a suspicious executable creates a new file in %TEMP% with a random name, then that file spawns a child process. The analyst wants to determine the exact parent-child process lineage and capture the command line used at launch. Which Windows artifact or tool provides this directly?

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

A SOC analyst is performing dynamic malware analysis in an isolated sandbox. The analyst wants to observe the malware's file system and Registry modifications in real time and then roll back the system to a clean state afterward. Which approach best supports this requirement?

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

A SOC analyst is conducting dynamic malware analysis on a suspicious binary in an isolated sandbox. The analyst observes that the malware creates a new file in the Startup folder and modifies a Run key in the registry. Which TWO artifacts should the analyst collect to document the persistence mechanisms for the forensic report? (Choose two.)

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

A SOC analyst is triaging a Linux web server that is suspected of hosting a web shell used by an attacker to maintain access. The analyst has a disk image and needs to identify indicators of the web shell and its activity. Which TWO artifacts should the analyst prioritize examining? (Choose two.)

A SOC analyst receives a suspicious PDF attachment from a user. The analyst wants to quickly determine whether the PDF contains JavaScript or an embedded executable without executing it. Which approach is most appropriate?

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

A SOC analyst is performing dynamic analysis of a suspicious Windows binary in an isolated lab. The analyst wants to observe the sample's interaction with the file system, registry, and network in real time, and also capture the arguments passed to Windows API calls. Which monitoring approach best provides this combined visibility?

A SOC analyst has acquired a forensic image of a compromised Windows host. To establish a defensible timeline of attacker activity, the analyst needs to place file system timestamps into a consistent, sortable sequence. Which step is essential before correlating timestamps across artifacts?

A SOC analyst is examining a Windows 10 workstation suspected of malware infection. During live response, the analyst needs to capture the current state of network connections, associated process IDs, and executable paths to identify potential command-and-control communication. Which native Windows command should the analyst run to obtain this information?

During a forensic investigation of a compromised Windows server, an analyst discovers an alternate data stream (ADS) attached to a legitimate system file. The analyst wants to extract the hidden content for malware analysis. Which Windows command should the analyst use to view the contents of the ADS?

A SOC analyst is conducting memory forensics on a compromised Windows host using Volatility 3. The analyst needs to identify malicious processes that may be hiding using rootkit techniques. Which two Volatility 3 plugins should the analyst use to detect hidden or unlinked processes? (Choose two.)

A SOC analyst is performing static analysis on a suspicious Windows Portable Executable (PE) file. The analyst wants to quickly determine the compile timestamp of the binary to assess whether it matches the reported incident timeline. Which field in the PE header should the analyst examine?