CCNA Malware Forensics Questions

MCQhard

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

A.Delete the config.ini file and the conhost.exe executable immediately.

B.Restore the system to a previous restore point.

C.Terminate the suspicious conhost.exe process and run a full antivirus scan.

D.Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.

AnswerD

Isolating the workstation from the network by disconnecting the cable or disabling the NIC immediately severs Command & Control (C2) channels and halts any lateral movement to other hosts, preserving the network flow data and the current state of live connections. Creating a forensic image of the hard disk using a write-blocker and bit-for-bit imaging tools maintains the integrity of evidence, allowing recovery of deleted files, unallocated space, and file system slack that may contain residual malware or attacker artifacts. This evidence-preserving approach aligns with forensic best practices, keeps proper chain of custody, and enables thorough static and dynamic analysis in a controlled lab environment—unlike the destructive or ineffective alternatives.

Why this answer

The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution.

Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Exam trap

EC-Council often tests the principle that containment and evidence preservation take precedence over immediate remediation, so candidates mistakenly choose to terminate the process or delete files (Option A or C) thinking they are stopping the threat, but this destroys volatile evidence and may trigger anti-forensic behavior.

How to eliminate wrong answers

Option A is wrong because deleting the config.ini file and conhost.exe executable destroys evidence and may trigger anti-forensic routines (e.g., file wiping or self-deletion) that could corrupt the memory dump or hinder analysis. Option B is wrong because restoring to a previous restore point overwrites critical system files and registry keys, destroying evidence of the infection and potentially leaving remnants of the malware in shadow copies or unallocated space. Option C is wrong because terminating the process and running an antivirus scan may alter the system state (e.g., killing the process removes its memory artifacts) and the scan could quarantine or delete malicious files, compromising the forensic integrity of the evidence.

Practice this question →

MCQmedium

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

A.API hooking

B.Process hollowing

C.Code injection

D.DLL injection

AnswerC

Code injection is the correct classification because the finding that code was inserted into a running process directly matches this term. It encompasses any technique that places executable code into the virtual address space of another process and then causes it to run, often by creating a remote thread or using an asynchronous procedure call. The stem's description is a general definition of code injection, not limited to a specific delivery vector.

Why this answer

Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Exam trap

The CHFI exam often tests the distinction between generic code injection and its specific subtypes (like DLL injection or process hollowing), trapping candidates who choose a narrower term when the question uses the broad phrase 'injecting code' without specifying the delivery mechanism.

How to eliminate wrong answers

Option A is wrong because API hooking intercepts and modifies function calls within a process (e.g., using SetWindowsHookEx or Detours), but it does not involve injecting new code into a separate process's memory space; it redirects existing calls. Option B is wrong because process hollowing replaces the legitimate code of a process (e.g., suspending explorer.exe, unmapping its original code, and writing malicious code into the same process) rather than injecting code into an already-running legitimate process; it creates a hollowed process from the start. Option D is wrong because DLL injection is a specific subtype of code injection that loads a DLL into a target process (using LoadLibrary or reflective loading), but the question does not specify that a DLL is involved—it only mentions 'injecting code,' which could be shellcode or other executable code, making the broader term 'code injection' more accurate.

Practice this question →

MCQmedium

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

A.Conduct a thorough static analysis using a disassembler and debugger to understand the code

B.Delete the suspicious file and run a full antivirus scan on the system

C.Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication

D.Perform a forensic imaging of the system again and compare with the original image

AnswerC

Re-running the sample in a sandbox with simulated network connectivity or a controlled network is the correct approach because many malware families remain dormant until they establish C2 communication, at which point they download additional payloads, exfiltrate data, or execute commands. A network-enabled sandbox provides a safe, but realistic environment where the analyst can observe DNS queries, HTTP/S connections, beaconing intervals, and the exact data exchanged with the C2 server. This dynamic analysis yields actionable indicators of compromise (IoCs) and reveals the malware's full functionality without risking real network infection.

Why this answer

The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Exam trap

The CHFI exam often tests the misconception that static analysis is always sufficient to determine maliciousness, but the trap here is that malware can be conditionally dormant and only activate when network connectivity is present, making dynamic analysis with network simulation essential.

How to eliminate wrong answers

Option A is wrong because static analysis alone cannot reliably determine if the file is malicious when it has no known hash and the sample is designed to only activate upon network connectivity; static analysis may miss obfuscated or conditionally executed code. Option B is wrong because deleting the file and running an antivirus scan is a reactive, non-analytical step that destroys evidence and does not answer whether the file is malicious; the file's hash is unknown, so antivirus may not detect it. Option D is wrong because performing another forensic imaging and comparing it to the original image would only show changes on disk, not reveal the runtime behavior or network-dependent activation of the malware; it is a redundant step that does not address the core question of whether the file is malicious.

Practice this question →

MCQhard

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

A.It is a sign that a rootkit has hidden files in the image

B.It indicates the location of the Master File Table (MFT) mirror

C.It is a virtual directory that contains files with no parent directory, often from deleted files

D.It is a standard NTFS metadata file that stores file permissions

AnswerC

In tools like The Sleuth Kit (tsk) and Autopsy, the virtual directory named $OrphanFiles (or displayed as 'V/V') is not a literal directory stored on the disk. It is dynamically generated to represent files whose MFT entries exist but whose parent directory references were lost, typically because the directory entry was deleted, overwritten, or corrupted while the file record itself remains in the MFT. This commonly occurs after a file is deleted, when the directory index entry is removed but the file's MFT record is not yet reused, or after a malformed directory entry prevents normal linkage in the tree.

Why this answer

In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Exam trap

The CHFI exam often tests the distinction between native NTFS metadata files (like $MFT, $Bitmap) and TSK virtual artifacts (like $OrphanFiles), so candidates mistakenly treat $OrphanFiles as a real NTFS system file rather than a forensic tool's reconstruction.

How to eliminate wrong answers

Option A is wrong because a rootkit hiding files would not manifest as a standard TSK virtual directory; rootkits typically use techniques like DKOM or hooking to conceal files, and $OrphanFiles is a normal TSK artifact for orphaned entries, not a sign of rootkit activity. Option B is wrong because the Master File Table (MFT) mirror is stored at the end of the NTFS volume (usually the last few clusters) and is not represented by a 'V/V' virtual directory in TSK; the MFT mirror is a metadata file ($MFTMirr), not a virtual directory. Option D is wrong because $OrphanFiles is not a standard NTFS metadata file; NTFS metadata files include $MFT, $LogFile, $Volume, etc., and $OrphanFiles is a TSK construct for forensic analysis, not a native NTFS file.

Practice this question →

MCQmedium

Based on the exhibit, what is the most likely indication of malware persistence?

A.services.exe PID 4321 is a known malware process

B.Windows Defender service is stopped, allowing malware to run

C.services.exe is listening on TCP port 4444, indicating possible code injection

D.svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

AnswerC

services.exe is the Windows Service Control Manager and should never expose listening TCP endpoints on its own; its normal IPC is via a named pipe used by subprocesses, not a network socket. Port 4444 is a well-known default payload port for Metasploit's meterpreter and is frequently used by backdoors, so an established listening socket on services.exe is a classic sign of injected shellcode. Because services.exe runs as SYSTEM, attackers often inject code into it to steal its high privileges and evade detection.

Why this answer

Services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

Exam trap

EC-Council often tests the misconception that any process named 'services.exe' or 'svchost.exe' is automatically malicious, when in fact the key indicator is abnormal behavior (like listening on a non-standard port) that deviates from the process's legitimate function.

How to eliminate wrong answers

Option A is wrong because services.exe is a legitimate Windows system process (the Service Control Manager), and PID 4321 alone does not indicate malware; malware often uses process names like svchost.exe or services.exe to blend in, so the PID itself is not a known malware identifier. Option B is wrong because while a stopped Windows Defender service could allow malware to run, the exhibit shows no evidence that Defender is stopped; the question asks for the most likely indication of persistence based on the exhibit, and a stopped service is a condition, not a direct indicator of persistence. Option D is wrong because svchost.exe hosting BFE (Base Filtering Engine) and MpsSvc (Windows Firewall) is normal behavior; these services are part of the Windows Firewall and do not indicate a bypass—in fact, they are the firewall itself, and their presence in svchost.exe is expected.

Practice this question →