Forensic Investigation And Malware Analysis

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?