312-39 Forensic Investigation And Malware Analysis — Timed 10 Questions

Question 1

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

10 minute time limit — choose an answer to begin.

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 2

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Accepted Answer

FTK Imager CLI. FTK Imager CLI is a standard tool used for capturing volatile memory in a forensically sound manner from a live system.

Answer

Sysmon

Answer

Process Explorer

Answer

Wireshark

Question 3

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user autostart key that malware and malicious scripts commonly abuse to establish persistence — anything listed there launches at user logon. File-less malware, which lives in memory or in script engines (PowerShell, WMI, mshta), frequently writes a Run key entry pointing to a script, LOLBin, or encoded command. This is the first place to check for user-level persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 4

A SOC analyst is investigating a compromised Windows 10 endpoint. The attacker used a novel dropper that does not write a persistent executable to disk; instead, it injects a reflective DLL into a legitimate process and then deletes its original payload. The analyst has a full memory capture from the endpoint. Which Volatility 3 plugin should the analyst use first to enumerate hidden or unlinked processes that may host the injected code?

Accepted Answer

windows.psscan. The analyst must first discover processes that are hidden from the normal kernel list. windows.psscan performs a pool-tag scan of physical memory and can recover unlinked or terminated process objects, making it the correct initial plugin for a reflective DLL injection scenario where the original dropper no longer exists on disk. Other plugins address network or memory-region artifacts but not process enumeration.

Answer

windows.netscan

Answer

windows.malfind

Answer

windows.pslist

Question 5

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 6

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 7

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 8

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 9

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 10

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file