312-39 Forensic Investigation And Malware Analysis — 10 Questions

Question 1

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FTK Imager CLI. FTK Imager CLI is a standard tool used for capturing volatile memory in a forensically sound manner from a live system.

Answer

Sysmon

Answer

Process Explorer

Answer

Wireshark

Question 2

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the standard repository for aggregating file hash results from multiple antivirus vendors.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 3

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is designed to simulate common internet services, including DNS, to study malware network behavior in an isolated environment.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 4

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) provides real-time monitoring of file system, Registry, and process activity.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 5

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 6

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is specifically designed to view the structure of Portable Executable (PE) files including headers and imports.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 7

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a tool that identifies file types and packers based on entropy and signature analysis.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 8

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Calculating a cryptographic hash (MD5/SHA256) of the original and the copy confirms that the data has not been altered during the duplication process.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 9

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 10

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis focuses on file properties, strings, and structural headers to identify potential malicious intent without execution.

Answer

Memory usage patterns

Answer

Network latency to the server