312-39 Forensic Investigation And Malware Analysis — 20 Questions

Question 1

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FTK Imager CLI. FTK Imager CLI is a standard tool used for capturing volatile memory in a forensically sound manner from a live system.

Answer

Sysmon

Answer

Process Explorer

Answer

Wireshark

Question 2

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the standard repository for aggregating file hash results from multiple antivirus vendors.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 3

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is designed to simulate common internet services, including DNS, to study malware network behavior in an isolated environment.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 4

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) provides real-time monitoring of file system, Registry, and process activity.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 5

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 6

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is specifically designed to view the structure of Portable Executable (PE) files including headers and imports.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 7

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a tool that identifies file types and packers based on entropy and signature analysis.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 8

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Calculating a cryptographic hash (MD5/SHA256) of the original and the copy confirms that the data has not been altered during the duplication process.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 9

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. Using a transparent SSL/TLS proxy (like an intercepting proxy) allows the analyst to decrypt traffic if the certificate is trusted by the client.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 10

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis focuses on file properties, strings, and structural headers to identify potential malicious intent without execution.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 11

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The 'Run' and 'RunOnce' keys are the most common locations for malware to ensure automatic execution upon user login.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 12

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Volatile data is lost when power is removed, making it the highest priority for collection.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 13

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Recording the exact time of collection and the identity of the person collecting it are fundamental requirements for chain of custody.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 14

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Persistence mechanisms ensure malware survives reboots or user logoffs; common locations include scheduled tasks, registry keys, and startup folders.

Answer

System memory dumps

Answer

Event log files

Question 15

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Event ID 4104 is generated when a script block is executed, providing insight into obfuscated PowerShell commands.

Answer

1102

Answer

4688

Answer

4624

Question 16

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Static analysis examines code without executing it, while dynamic analysis observes behavior during execution.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems