212-89 Malware Incidents — 20 Questions

Question 1

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

Accepted Answer

ip.addr == [IP_ADDRESS]. The filter 'ip.addr == [IP_ADDRESS]' specifically isolates all packets associated with the destination IP suspected of being the C2 server.

Answer

tcp.port == 80

Answer

frame.len > 1000

Answer

http.request

Question 2

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Accepted Answer

Establishing system persistence. Modifying this registry key is a classic technique for establishing persistence, ensuring the malware executes automatically upon system startup.

Answer

Injecting code into explorer.exe

Answer

Escalating user privileges

Answer

Disabling the Windows Firewall

Question 3

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

Accepted Answer

windows.psscan. The 'psxview' plugin in older versions or 'pslist' vs 'psscan' comparison helps identify hidden processes. In Volatility 3, 'windows.psscan' is used to find processes that are not linked in the active process list.

Answer

windows.netscan

Answer

windows.modules

Answer

windows.vadyarascan

Question 4

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

Accepted Answer

Restore data to a sandbox or isolated VLAN. Restoring data into a clean, isolated environment is critical to ensure that the malware is not re-introduced or that the backup itself is not infected.

Answer

Scan the backup media with the same AV used previously

Answer

Reboot the domain controllers

Answer

Change all user passwords

Question 5

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 6

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable or disabling the network interface card via BIOS/Switch port prevents C2 communication while keeping the system powered on for memory forensics.

Answer

Shut down the computer immediately

Answer

Delete the suspicious files

Answer

Run a full antivirus scan

Question 7

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

Accepted Answer

Hiding malicious code inside a legitimate process. Process hollowing is used to hide malicious code within the memory space of a legitimate, running process to evade detection by security software.

Answer

Brute-forcing system credentials

Answer

Encrypting local user files

Answer

Creating a hidden user account

Question 8

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Accepted Answer

Select the process and click Options > Check VirusTotal. Process Explorer provides a 'Check VirusTotal' feature under the Options menu to automatically submit file hashes to VirusTotal for reputation verification.

Answer

Use the 'Find Handle or DLL' search bar for the file name

Answer

Right-click the process and select 'Verify Signature'

Answer

Navigate to View > Lower Pane View > Handles

Question 9

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

Accepted Answer

Injecting a thread into another process. The 'CreateRemoteThread' API is commonly used to inject a thread into a separate process, which is a fundamental step in DLL injection and code execution.

Answer

Opening a network socket

Answer

Deleting files on disk

Answer

Modifying system time

Question 10

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

Accepted Answer

Executing encoded PowerShell scripts. Using 'PowerShell.exe' to execute base64-encoded scripts directly from memory is a quintessential LotL technique.

Answer

Running a commercial vulnerability scanner

Answer

Installing a custom rootkit driver

Answer

Downloading an EXE from an unknown site

Question 11

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

Accepted Answer

Magnet RAM Capture. Magnet RAM Capture or WinPmem are standard tools for acquiring full memory dumps in a forensic-sound manner.

Answer

Wireshark

Answer

Windows Task Manager

Answer

Event Viewer

Question 12

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

Accepted Answer

Calculate the file hash. Calculating the file hash is the first step to verify the file's reputation against known databases like VirusTotal before performing intrusive analysis.

Answer

Re-image the computer

Answer

Delete the file immediately

Answer

Execute the file in a debugger

Question 13

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 14

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

Accepted Answer

Received header. The 'Received' headers show the path the email took and the IP addresses of the mail servers involved, helping trace the original sender.

Answer

Subject line

Answer

Message-ID

Answer

Content-Type

Question 15

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 16

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

Accepted Answer

Handle. Sysinternals Handle is designed to list all open handles, including Mutexes, on a running system.

Answer

TCPView

Answer

Procmon

Answer

Autoruns

Question 17

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?

Accepted Answer

Incident Log. An Incident Log (or Chain of Custody record) is critical for documenting every step, tool, and decision made during the response process.

Answer

User Manual

Answer

System Backup

Answer

Vulnerability Assessment Report

Question 18

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

Accepted Answer

PEview. PEview or CFF Explorer allows for detailed inspection of the Portable Executable structure, including section headers which often reveal abnormal names (e.g., UPX) for packed files.

Answer

Wireshark

Answer

Process Explorer

Answer

Regedit

Question 19

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Accepted Answer

Firewall logs. Firewall logs provide a record of all outbound connections and are the most reliable source for identifying destination IP addresses in an exfiltration event.

Answer

Application logs

Answer

Local security policy settings

Answer

System event logs

Question 20

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Accepted Answer

Block propagation ports at the network level. Isolating the affected segments or blocking the ports used for the worm's propagation (e.g., SMB/445) is essential to stop lateral movement.

Answer

Update the BIOS on all machines

Answer

Disable the internet gateway

Answer

Email all users to reboot