212-89 Malware Incidents — Timed 20 Questions

Question 1

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

20 minute time limit — choose an answer to begin.

Accepted Answer

windows.psscan. windows.psscan in Volatility 3 scans physical memory for pool tags associated with EPROCESS structures, bypassing the active process linked list that rootkits typically unlink. Comparing its output against windows.pslist (which walks the EPROCESS linked list) reveals hidden processes — any process in psscan but not pslist is a strong rootkit indicator.

Answer

windows.netscan

Answer

windows.modules

Answer

windows.vadyarascan

Question 2

You are analyzing a malware sample that has infected a Windows system. The malware appears to be communicating with a remote server using DNS queries. You suspect it is using DNS tunneling to exfiltrate data. Which tool would be most effective for detecting and analyzing this DNS tunneling activity?

Accepted Answer

A network security monitoring (NSM) tool with DNS anomaly detection, such as Zeek or Suricata. DNS tunneling involves encoding data in DNS queries and responses, often using long or unusual domain names. Detecting it requires analyzing DNS traffic patterns and payloads. NSM tools like Zeek or Suricata can be configured to detect such anomalies, making them the most effective for this scenario. General packet capture tools lack the built-in detection capabilities.

Answer

Sysmon with DNS query logging

Answer

Wireshark with a display filter for DNS

Answer

A dedicated DNS tunneling detection tool like iodine or dnscat2

Question 3

An incident handler is investigating a malware infection on a Windows server. The malware is suspected to have established persistence. Which TWO of the following Windows registry locations are commonly used by malware to achieve persistence? (Choose two.)

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The Run key and Services key are two of the most common registry locations for malware persistence. The Run key executes programs at user logon, while the Services key allows malware to run as a system service at boot. Both are frequently leveraged due to their reliability and ease of use. Other keys like Winlogon can be used but are less common and riskier for the malware author.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Answer

HKEY_CLASSES_ROOT\exefile\shell\open\command

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 4

You are analyzing a malware sample that communicates with its command-and-control server over HTTPS on port 443 but uses a hardcoded IP address and a self-signed certificate. The malware also beacons at irregular intervals to avoid pattern detection. Which network indicator is most reliable for detecting this malware across the enterprise?

Accepted Answer

The hardcoded destination IP address and the self-signed certificate's serial number. A hardcoded IP address and a self-signed certificate serial number are stable, specific indicators that the malware must use to communicate successfully. These values can be searched across firewall and proxy logs and TLS inspection platforms to identify all infected hosts, whereas port usage, encryption, timing, and user agents are too generic to be reliable.

Answer

The user agent string presented during the TLS handshake

Answer

The irregular beaconing interval observed in network flow data

Answer

The HTTPS port 443 usage and the presence of encrypted traffic

Question 5

During a malware incident, an analyst discovers a malicious DLL that is loaded by a legitimate Windows process. The DLL is not signed and resides in a user-writable directory. The analyst wants to confirm whether the DLL is being loaded via DLL search order hijacking. Which Windows registry location should the analyst examine to identify the DLL search order?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs. DLL search order hijacking occurs when a malicious DLL is placed in a directory that is searched before the legitimate DLL's location. The KnownDLLs registry key lists DLLs that are always loaded from the system directory, bypassing the search order. If the malicious DLL is not in KnownDLLs, it may be hijacked. Examining this key is essential to confirm the hijacking mechanism.

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Answer

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Question 6

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

Accepted Answer

ip.addr == [IP_ADDRESS]. The question asks how to isolate traffic to a specific external IP observed during beaconing. In Wireshark, the display filter 'ip.addr == [IP_ADDRESS]' matches all packets where the source OR destination IP equals the given address, which is exactly what is needed to isolate the C2 channel. This works regardless of port or protocol, making it the most reliable filter for a known malicious IP.

Answer

tcp.port == 80

Answer

frame.len > 1000

Answer

http.request

Question 7

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

Accepted Answer

Establishing system persistence. The Windows Run registry key is a well-known autostart location that causes programs to execute automatically when a user logs in. Malware modifying this key is attempting to ensure it runs every time the system starts, which is the definition of establishing persistence. This technique is catalogued in MITRE ATT&CK as T1547.001 (Registry Run Keys / Startup Folder).

Answer

Injecting code into explorer.exe

Answer

Escalating user privileges

Answer

Disabling the Windows Firewall

Question 8

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

Accepted Answer

Restore data to a sandbox or isolated VLAN. Restoring data to a sandbox or isolated VLAN before production is the most critical step because it verifies the backups are clean and free of the ransomware or its persistence mechanisms. Ransomware frequently targets or encrypts backup repositories, and restoring directly to production risks reinfecting the environment. Testing in isolation confirms data integrity and allows scanning without exposing production systems.

Answer

Scan the backup media with the same AV used previously

Answer

Reboot the domain controllers

Answer

Change all user passwords

Question 9

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

Accepted Answer

condition: $a or $b. YARA uses the 'or' operator within the condition section to evaluate multiple criteria, allowing a match if either condition is met.

Answer

condition: $a + $b

Answer

condition: $a != $b

Answer

condition: $a && $b

Question 10

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable is the correct containment action because it immediately severs the workstation's communication with the network (stopping lateral movement, C2 beaconing, and data exfiltration) while leaving the system powered on. This preserves volatile evidence such as RAM contents, running processes, network connections, and encryption keys that would be lost on shutdown. It is the least destructive way to isolate a host during the containment phase of incident response.

Answer

Shut down the computer immediately

Answer

Delete the suspicious files

Answer

Run a full antivirus scan

Question 11

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

Accepted Answer

Hiding malicious code inside a legitimate process. Process hollowing is a code-injection technique in which malware creates a legitimate process in a suspended state, unmaps its original code from memory, and replaces it with malicious code, then resumes execution. The primary purpose is to hide malicious activity inside a trusted, legitimate process so that it evades detection by security tools that trust known executables. This is why EDR solutions flag it as a high-severity event.

Answer

Brute-forcing system credentials

Answer

Encrypting local user files

Answer

Creating a hidden user account

Question 12

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

Accepted Answer

Select the process and click Options > Check VirusTotal. Sysinternals Process Explorer integrates directly with VirusTotal via Options > Check VirusTotal, which submits the selected process's file hash to VirusTotal and displays the multi-engine detection ratio in a new column. This lets an analyst assess file reputation without leaving the tool or manually uploading the binary. It is the fastest way to triage a suspicious PID during live malware response.

Answer

Use the 'Find Handle or DLL' search bar for the file name

Answer

Right-click the process and select 'Verify Signature'

Answer

Navigate to View > Lower Pane View > Handles

Question 13

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

Accepted Answer

Injecting a thread into another process. CreateRemoteThread is a Windows API used to start a thread in the virtual address space of another process. Malware uses it for process injection — typically after allocating memory in the target with VirtualAllocEx and writing shellcode with WriteProcessMemory, it calls CreateRemoteThread to execute the payload inside a legitimate process, evading detection and inheriting that process's privileges.

Answer

Opening a network socket

Answer

Deleting files on disk

Answer

Modifying system time

Question 14

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

Accepted Answer

Executing encoded PowerShell scripts. Using 'PowerShell.exe' to execute base64-encoded scripts directly from memory is a quintessential LotL technique.

Answer

Running a commercial vulnerability scanner

Answer

Installing a custom rootkit driver

Answer

Downloading an EXE from an unknown site

Question 15

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

Accepted Answer

Magnet RAM Capture. Magnet RAM Capture or WinPmem are standard tools for acquiring full memory dumps in a forensic-sound manner.

Answer

Wireshark

Answer

Windows Task Manager

Answer

Event Viewer

Question 16

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

Accepted Answer

Calculate the file hash. Calculating the file hash is the correct first step because it preserves the integrity of the evidence and allows the file to be identified against known malware databases (e.g., VirusTotal, NIST NSRL) without altering or executing it. Hashing is non-destructive, produces a unique fingerprint (MD5/SHA-256), and maintains chain-of-custody for any subsequent forensic or legal action. This aligns with the order of volatility and standard incident response handling procedures.

Answer

Re-image the computer

Answer

Delete the file immediately

Answer

Execute the file in a debugger

Question 17

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

Accepted Answer

Implement PowerShell Constrained Language Mode. Disabling PowerShell for non-administrative users or implementing Constrained Language Mode is a key defense against fileless script-based attacks.

Answer

Enable auto-updates for all applications

Answer

Install an extra antivirus

Answer

Enable full disk encryption

Question 18

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

Accepted Answer

Received header. The Received header is the most important field because each mail server that handles a message prepends its own Received header, creating a chronological chain that traces the message's path from origin to destination. By reading the headers bottom-up (oldest first), an investigator can identify the originating IP address and mail server, which is essential for determining the true source of a phishing email. Subject, Message-ID, and Content-Type can all be trivially spoofed or fabricated by the sender and carry no routing information.

Answer

Subject line

Answer

Message-ID

Answer

Content-Type

Question 19

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

Accepted Answer

Evading static C2 blocklists. DGA is used to generate a large number of domain names daily, making it difficult for defenders to block the command-and-control server effectively.

Answer

Spreading via local network shares

Answer

Encrypting the malware payload

Answer

Hiding processes from Task Manager

Question 20

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

Accepted Answer

Handle. Handle (Sysinternals Handle) is the correct tool because it enumerates open handles — including named mutexes — held by processes on a Windows system. Running 'handle.exe -a' lists all handle types, and you can search for the mutex name associated with the malware, confirming infection and enabling detection signatures. Mutexes are kernel objects, and Handle is purpose-built to display them per process.

Answer

TCPView

Answer

Procmon

Answer

Autoruns