312-39 Forensic Investigation And Malware Analysis — Timed 15 Questions

Question 1

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

15 minute time limit — choose an answer to begin.

Accepted Answer

OleDump. OleDump is a specialized tool used to analyze OLE files (like Office docs) to extract VBA macros and embedded objects.

Answer

Burp Suite

Answer

Wireshark

Answer

Autopsy

Question 2

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Accepted Answer

FTK Imager CLI. FTK Imager CLI is a standard tool used for capturing volatile memory in a forensically sound manner from a live system.

Answer

Sysmon

Answer

Process Explorer

Answer

Wireshark

Question 3

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user autostart key that malware and malicious scripts commonly abuse to establish persistence — anything listed there launches at user logon. File-less malware, which lives in memory or in script engines (PowerShell, WMI, mshta), frequently writes a Run key entry pointing to a script, LOLBin, or encoded command. This is the first place to check for user-level persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Classes

Answer

HKLM\System\CurrentControlSet\Control\Session Manager

Question 4

A SOC analyst is investigating a compromised Windows 10 endpoint. The attacker used a novel dropper that does not write a persistent executable to disk; instead, it injects a reflective DLL into a legitimate process and then deletes its original payload. The analyst has a full memory capture from the endpoint. Which Volatility 3 plugin should the analyst use first to enumerate hidden or unlinked processes that may host the injected code?

Accepted Answer

windows.psscan. The analyst must first discover processes that are hidden from the normal kernel list. windows.psscan performs a pool-tag scan of physical memory and can recover unlinked or terminated process objects, making it the correct initial plugin for a reflective DLL injection scenario where the original dropper no longer exists on disk. Other plugins address network or memory-region artifacts but not process enumeration.

Answer

windows.netscan

Answer

windows.malfind

Answer

windows.pslist

Question 5

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Accepted Answer

VirusTotal. VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

Answer

Malwarebytes Nebula

Answer

Nessus

Answer

Splunk ES

Question 6

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Accepted Answer

INetSim. INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Answer

Wireshark

Answer

Netcat

Answer

Nmap

Question 7

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Accepted Answer

Process Monitor. Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

Answer

Autoruns

Answer

TCPView

Answer

Process Explorer

Question 8

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Accepted Answer

PEview. PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

Answer

Procmon

Answer

Cuckoo Sandbox

Answer

x64dbg

Question 9

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Accepted Answer

Detect It Easy (DIE). Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

Answer

Process Hacker

Answer

Wireshark

Answer

HashCalc

Question 10

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Accepted Answer

Calculate a cryptographic hash of both. Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Answer

Mount the image read-write

Answer

Run an antivirus scan

Answer

Rename the file

Question 11

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Accepted Answer

Use an SSL/TLS intercepting proxy. An SSL/TLS intercepting proxy sits between the malware and the C2 server, terminating the TLS session on both sides using a trusted CA certificate installed on the endpoint. This allows the analyst to decrypt and inspect the plaintext HTTP or custom protocol inside the TLS tunnel without possessing the malware's private key. It is the standard technique for inspecting encrypted C2 traffic in a controlled lab or proxy-enabled environment.

Answer

Use Nmap to scan for open ports

Answer

Use Wireshark to brute force the key

Answer

Analyze the payload in a debugger

Question 12

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Accepted Answer

Embedded strings (e.g., C2 domains, IP addresses). Static analysis examines a binary without executing it, so the analyst inspects its contents and metadata directly. Option B is correct because embedded strings often reveal hardcoded C2 domains, IP addresses, URLs, file paths, and other artifacts that expose the malware's intent and infrastructure. Option C is correct because computing cryptographic hashes such as MD5 or SHA256 provides a unique fingerprint used to identify, correlate, and look up the sample in threat-intelligence databases like VirusTotal without running it. Option E is correct because the Import Address Table lists the Windows API functions the binary references (e.g., CreateRemoteThread, InternetOpen), which strongly hints at its capabilities such as process injection or network communication. Option A is not a static indicator since memory usage patterns only emerge during dynamic execution or runtime monitoring. Option D is likewise dynamic, as network latency to a server can only be measured by executing the sample and observing live traffic.

Answer

Memory usage patterns

Answer

Network latency to the server

Question 13

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Accepted Answer

Active network connections. Option C (Active network connections) is correct because running connections exist only in memory and in the kernel's network state tables; once the system is powered off or the connection closes, that state is lost, so it must be captured first with tools like netstat, ss, or tcpdump. Option E (System RAM contents) is correct because RAM is the most volatile evidence of all—it holds running processes, encryption keys, open files, and network buffers that vanish the instant power is removed, making a memory image (e.g., via FTK Imager or WinPmem) a top priority. The unmarked options are not volatile: browser history files (A) and registry hive files (B) reside on disk and persist after shutdown, and the hard drive partition table (D) is likewise stored on the disk's master boot record or GPT, remaining intact until the drive is modified.

Answer

Browser history files

Answer

Registry hive files on disk

Answer

Hard drive partition table

Question 14

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Accepted Answer

The name of the individual collecting the evidence. Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail. Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Answer

The color of the hard drive casing

Answer

The CPU manufacturer

Answer

The system temperature at the time

Question 15

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in. System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Answer

System memory dumps

Answer

Event log files