CHFI Mobile and Malware Forensics Practice Question

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

⚠ Common exam trap

EC-Council often tests the distinction between persistence (surviving reboot) and other behavioral indicators like mutex creation or network connections, so the trap here is confusing a mutex (used for single-instance control) with a persistence mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Modifying the hosts file with an entry for 192.168.1.1

Modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Modifying the hosts file with an entry for 192.168.1.1
Why this is correct
The hosts file at %SystemRoot%\System32\drivers\etc\hosts is consulted by the Windows DNS resolver on every name-resolution attempt, so an entry mapping a domain to 192.168.1.1 changes system-wide resolution behavior even after a reboot. This is a persistent system-level configuration change that can silently redirect a target hostname to an attacker-controlled IP, enabling traffic interception, credential harvesting, or bypass of DNS-based defenses. Unlike transient runtime actions, this modification remains active until the file is edited or the entry is removed.
✗
Connecting to IP 185.130.5.21 on port 443
Why it's wrong here
Establishing an outbound connection to 185.130.5.21 on TCP/443 is a runtime network event: the socket exists only while the process is alive and the TCP session is active. No registry value, file, service, or scheduled job is created, so the connection does not re-establish automatically after the machine reboots or the malware process terminates. It may indicate C2 beaconing or data exfiltration, but it is not an auto-start persistence indicator.
✗
Writing temporary files to %TEMP%
Why it's wrong here
Dropping files into %TEMP% leverages a user-writable directory that is routinely purged by the operating system, disk cleanup, or user-level temp cleaners. Unless the malware also creates a Run key, service, scheduled task, or other trigger to re-execute that payload, the temporary files disappear after reboot and are not sufficient to maintain persistence. At best they are a staging location or a transient dropper artifact.
✗
Creating the mutex 'Global\Mtx_Update'
Why it's wrong here
A named mutex such as Global\Mtx_Update is a kernel synchronization object used to enforce mutual exclusion, not a configuration artifact. Its lifetime is tied to open handles; when all handles close or the creating process exits, the mutex object is destroyed. Creating it merely prevents multiple malware instances from running concurrently and provides no mechanism to relaunch the executable at startup, so it is unrelated to persistence.

Visual reference

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question