312-39 Forensic Investigation And Malware Analysis — 20 Questions

Question 1

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 2

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Accepted Answer

FTK Imager CLI. FTK Imager CLI is a standard tool used for capturing volatile memory in a forensically sound manner from a live system.

Answer

Sysmon

Answer

Process Explorer

Answer

Wireshark

Question 3

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user autostart key that malware and malicious scripts commonly abuse to establish persistence — anything listed there launches at user logon. File-less malware, which lives in memory or in script engines (PowerShell, WMI, mshta), frequently writes a Run key entry pointing to a script, LOLBin, or encoded command. This is the first place to check for user-level persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 4

A SOC analyst is investigating a compromised Windows 10 endpoint. The attacker used a novel dropper that does not write a persistent executable to disk; instead, it injects a reflective DLL into a legitimate process and then deletes its original payload. The analyst has a full memory capture from the endpoint. Which Volatility 3 plugin should the analyst use first to enumerate hidden or unlinked processes that may host the injected code?

Accepted Answer

windows.psscan. The analyst must first discover processes that are hidden from the normal kernel list. windows.psscan performs a pool-tag scan of physical memory and can recover unlinked or terminated process objects, making it the correct initial plugin for a reflective DLL injection scenario where the original dropper no longer exists on disk. Other plugins address network or memory-region artifacts but not process enumeration.

Answer

windows.netscan

Answer

windows.malfind

Answer

windows.pslist

Question 5

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 6

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 7

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 8

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 9

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 10

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 11

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. An SSL/TLS intercepting proxy sits between the malware and the C2 server, terminating the TLS session on both sides using a trusted CA certificate installed on the endpoint. This allows the analyst to decrypt and inspect the plaintext HTTP or custom protocol inside the TLS tunnel without possessing the malware's private key. It is the standard technique for inspecting encrypted C2 traffic in a controlled lab or proxy-enabled environment.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 12

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis examines a binary without executing it, so the analyst inspects its contents and metadata directly. Option B is correct because embedded strings often reveal hardcoded C2 domains, IP addresses, URLs, file paths, and other artifacts that expose the malware's intent and infrastructure. Option C is correct because computing cryptographic hashes such as MD5 or SHA256 provides a unique fingerprint used to identify, correlate, and look up the sample in threat-intelligence databases like VirusTotal without running it. Option E is correct because the Import Address Table lists the Windows API functions the binary references (e.g., CreateRemoteThread, InternetOpen), which strongly hints at its capabilities such as process injection or network communication. Option A is not a static indicator since memory usage patterns only emerge during dynamic execution or runtime monitoring. Option D is likewise dynamic, as network latency to a server can only be measured by executing the sample and observing live traffic.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 13

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Option C (Active network connections) is correct because running connections exist only in memory and in the kernel's network state tables; once the system is powered off or the connection closes, that state is lost, so it must be captured first with tools like netstat, ss, or tcpdump. Option E (System RAM contents) is correct because RAM is the most volatile evidence of all—it holds running processes, encryption keys, open files, and network buffers that vanish the instant power is removed, making a memory image (e.g., via FTK Imager or WinPmem) a top priority. The unmarked options are not volatile: browser history files (A) and registry hive files (B) reside on disk and persist after shutdown, and the hard drive partition table (D) is likewise stored on the disk's master boot record or GPT, remaining intact until the drive is modified.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 14

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 15

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files

Question 16

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Windows Event ID 4104 is generated by PowerShell's Script Block Logging feature and records the full text of executed script blocks, including obfuscated or dynamically constructed code. This makes it the primary event ID for reconstructing PowerShell-based attacks. Event ID 4104 appears in the 'Microsoft-Windows-PowerShell/Operational' log and is essential for detecting fileless malware and encoded command execution.

Answer

1102

Answer

4688

Answer

4624

Question 17

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Option C is correct because static analysis examines a binary's code, headers, strings, imports, and structure without ever running it, which is its defining characteristic. Option A is correct because dynamic analysis observes the malware's actual behavior at runtime, so it must be executed inside a sandbox or otherwise isolated environment to prevent infection of the host and to safely capture process, file, registry, and network activity. Option B is incorrect because static analysis is not always faster; large or obfuscated/packed binaries can make it slow, while dynamic analysis may complete quickly. Option D is incorrect because static analysis can reveal malicious intent through indicators such as suspicious API imports, embedded strings, or malicious code patterns. Option E is incorrect because dynamic analysis applies to Windows, Linux, macOS, and other platforms, not only Linux systems.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems

Question 18

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

Accepted Answer

Process Explorer. Process Explorer is the correct tool because it provides a comprehensive, real-time view of running processes, including parent-child relationships, command-line arguments, and loaded modules. These features allow the analyst to quickly assess whether svchost.exe running from an unusual path is legitimate or malicious, which is critical for rapid triage in a SOC environment.

Answer

Process Monitor

Answer

TCPView

Answer

Autoruns

Question 19

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Accepted Answer

The file has a high entropy value, especially in the code sections.. High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Answer

The file size is less than 100 KB.

Answer

The file has a large number of imported functions from kernel32.dll.

Answer

The file contains a digital signature from a known vendor.

Question 20

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

Accepted Answer

netstat -ano. The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Answer

nslookup

Answer

arp -a

Answer

tracert