CCNA Cbrops Host Analysis Questions

The 'MZ' magic bytes (0x4D 0x5A) are the signature of a Portable Executable (PE) file, indicating it is a Windows executable. This is the first step in file identification.

Common persistence mechanisms on Linux include cron jobs and systemd services. Bash history only records commands, not persistence. /proc is a virtual filesystem. /etc/passwd lists users but doesn't directly show persistence.

A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Prefetch files (*.pf) are created by Windows to speed up application loading. They contain metadata about executed programs, including execution count and last run time.

On most Linux distributions, /var/log/auth.log (or /var/log/secure on Red Hat-based systems) records authentication events including SSH logins.

pstree shows parent-child relationships between processes, which pslist does not.

Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

pstree shows process hierarchy, netscan lists network connections, and malfind detects injected code.

The magic bytes 50 4B 03 04 correspond to a ZIP archive (PK is the signature). This suggests the file is actually a ZIP file disguised with a PDF extension, possibly containing malicious content.

Malfind detects injected code by scanning for VADs with specific protection flags. 'VadS' indicates a VAD with PAGE_EXECUTE_READWRITE protection, common for shellcode injection. 'Vadl' is for large pages. The presence of these tags strongly suggests code injection.

Process Explorer provides detailed process tree view and command line information, unlike Task Manager's default view or tasklist.

The 'systemctl disable' command prevents a service from starting automatically at boot.

In auth.log, failed SSH logins typically contain 'Failed password' messages. Accepted password indicates success, and Invalid user may accompany failed attempts but the key indicator is 'Failed password'.

The cron job is defined in /etc/cron.d/ because this directory allows system administrators to drop individual cron configuration files that are parsed by the cron daemon. Unlike /etc/crontab and /var/spool/cron/ (which contain user-specific crontabs), /etc/cron.d/ is a standard location for package-maintained or custom cron jobs that run with system privileges. The fact that the analyst found nothing in the other two locations strongly suggests the job is defined in /etc/cron.d/.

malfind scans for injected code by finding memory regions with suspicious permissions (e.g., RWX). dlllist lists loaded DLLs, and ldrmodules can find hidden or suspicious modules.

Image File Execution Options (IFEO) allow setting debuggers for executables. Malware can abuse this for persistence or to inject code by setting a debugger that launches the malware when the legitimate executable is run.

malfind specifically detects injected code, and ldrmodules (or dlllist with ldrmodules) helps detect hidden/unlinked DLLs that may indicate injection. pslist shows processes, pstree shows tree, and netscan shows connections.

The 'pstree' plugin in Volatility displays the process tree with parent-child relationships, helping identify suspicious process hierarchies.

A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.

Event ID 4625 is a failed logon attempt, recorded in the Security log.

The Run and RunOnce keys in both HKLM and HKCU cause programs to execute at user logon. They are commonly abused for persistence.

Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

The pstree command shows the process hierarchy in a tree format, clearly displaying parent-child relationships. This helps trace how the malicious process was launched.

Checking /var/log/auth.log for successful SSH logins on that port helps identify unauthorized connections.

Checking /proc/[pid]/cmdline for the process ID can reveal if it has a command line; legitimate kernel threads have empty cmdline, while user-space processes do not.

Prefetch files (.pf) contain the last run time, run count, and paths of files loaded by the executable. This helps determine how many times the malware was executed and when.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location for user-level autoruns.

High entropy suggests the file is packed or encrypted. Normal executables have lower entropy. Packed malware uses compression/encryption to obfuscate code.

Malware often spawns child processes from unusual parents (e.g., Microsoft Word spawning cmd.exe) and may have suspicious command-line arguments.

Event ID 4648 indicates explicit credentials were used to log on, such as running a program as a different user or using secondary logon. It is distinct from interactive logon (4624) or failed logon (4625).

Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Bash history is stored in ~/.bash_history for each user.

psxview compares process listings from different sources to find discrepancies, while malfind detects injected code. pslist lists normally, and cmdline shows command lines.

The 'ss' command with options -t (TCP), -l (listening), -n (numeric), -p (process) shows listening TCP ports and the corresponding processes.

Prefetch files have the .pf extension and contain execution data for applications.

Bash history contains commands executed by users, auth.log records login attempts, and cron jobs can be used for persistence. /etc/passwd shows user accounts but not activity.

The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

High entropy (close to 8) suggests the file is packed or encrypted, as compressed or encrypted data has high randomness. This is often used by malware to evade signature detection.

Creating a systemd service unit is a common Linux persistence technique because systemd is the default init system for most modern Linux distributions. An attacker can place a malicious service file (e.g., /etc/systemd/system/evil.service) that automatically starts the malware at boot or after a crash, ensuring continued access even after a reboot.

Option D is correct because legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Event ID 4625 is a failed logon attempt. Multiple failures from the same IP suggest a brute-force attack.

Process Explorer provides detailed process information including parent PID and command line, while Task Manager and tasklist show limited details. Volatility is a memory analysis tool, not for live host analysis.

The 'sc query' command with the service name provides detailed information including binary path and start type.

Option C is correct because in a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

The 'malfind' command scans for anomalous memory regions that often indicate code injection, such as executable pages not backed by a file on disk.

Event ID 4624 is logged when a user successfully logs on to a system.

Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

AppInit_DLLs loads DLLs into every process that loads user32.dll, making it a stealthy persistence mechanism.

Event ID 4648 (A logon was attempted using explicit credentials) is correct because it records when a user explicitly provides credentials to run a program or service, which is a common technique in privilege escalation (e.g., runas) and credential theft (e.g., pass-the-hash). This event captures the target account, source process, and target workstation, making it invaluable for detecting lateral movement or credential misuse.

User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), named after the user.

Task Scheduler (taskschd.msc) provides a GUI to view all scheduled tasks, their triggers, and actions.

The 'sc' command-line tool (Service Control) can query and modify services. 'sc query' shows the status, and 'sc qc' shows the configuration.

The Run registry key under HKLM and HKCU is a common location for programs to automatically start at boot. Malicious software often adds entries here to achieve persistence.

Event 4720 is account creation, 4726 is deletion; rapid sequence suggests temporary account used for malicious activity.

Event ID 4720 is logged when a user account is created in Active Directory or local SAM.

malfind detects injected code, dlllist/ldrmodules show loaded modules anomalies, and pslist/pstree identify suspicious processes.

Crontabs for users are stored in /var/spool/cron/crontabs/ and system-wide cron jobs are in /etc/crontab.

Prefetch shows evidence of execution, run count indicates how many times, and the path reveals the location. However, prefetch does not show the parent process or command-line arguments.

A process with PPID 0 is unusual and may indicate a rootkit or direct kernel manipulation. Normal processes have a parent, except for the System Idle Process (PID 0).

Event ID 4720 indicates account creation, and 4726 indicates account deletion. The rapid creation and deletion may indicate an attempt to avoid detection or create a temporary account.

Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

The 'sc query' command retrieves information about services, including their state and start type (auto, manual, disabled). It is useful for identifying suspicious services.

Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

malfind identifies suspicious memory regions, such as injected code. pslist lists processes, netscan shows network connections, and dlllist lists loaded DLLs.

The Run and RunOnce keys under HKLM and HKCU are common persistence mechanisms. Malware often adds entries here to execute automatically at user logon.

High entropy suggests compressed or encrypted data, common in packed executables. Tools like PEiD or manual analysis using 'strings' and entropy calculation can confirm packing. Hash comparison with VirusTotal can also help.

4625 is failed logon, 4624 is successful logon. These are the standard events for logon success/failure.

Cron jobs, systemd services, and bash history are common artifacts for persistence. Cron and systemd can schedule execution, bash history may show past commands.

The 'data' result indicates the file's magic bytes do not match known executables, suggesting it might be packed or obfuscated.

The /proc filesystem contains per-process directories. Checking /proc/[pid]/cmdline and /proc/[pid]/status reveals the command line and parent PID.

Cron jobs, systemd services, and bash history are key for persistence detection. SSH keys can also be used. /proc/cpuinfo is hardware info, not persistence.