Malware Incidents

A user reports their Windows 10 workstation is running very slowly and displaying unexpected pop-up ads in the browser. The incident handler suspects an adware infection. After isolating the machine, which Windows tool should the handler use to identify the malicious process consuming CPU and its associated network connections?

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

A healthcare organization's endpoint detection tool alerts on a workstation that is repeatedly connecting to a domain generated by a domain generation algorithm (DGA). The incident handler wants to proactively block future DGA domains before they are weaponized. Which containment strategy is most effective?

A user reports that their Windows 10 workstation is displaying a message claiming that all files have been encrypted and demanding payment in Bitcoin. The incident handler suspects ransomware. Which immediate action should the handler take first to prevent further encryption?

During a malware incident investigation, you observe a Windows host establishing periodic outbound HTTPS connections to an unknown IP address every 60 seconds, with small, uniform packet sizes. Which two characteristics most strongly indicate this is command-and-control (C2) beaconing rather than legitimate traffic? (Choose two.)

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

A malware incident has been detected on a Windows server. The incident handler needs to identify the persistence mechanism used by the malware. The handler runs the 'Autoruns' tool and observes an entry in the 'Scheduled Tasks' tab that points to a suspicious executable in the user's AppData folder. Which Windows feature is being abused for persistence?

During a malware incident on a Windows 10 workstation, you observe that a scheduled task named "UpdaterSvc" executes a binary in C:\Users\Public\svchost.exe every 15 minutes and re-creates its own registry Run key if deleted. The user reports the malware reappears after each cleanup. Which containment action BEST addresses this persistence while preserving forensic evidence?

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

A company's security team detects that a server is communicating with a known malicious IP address every hour. The traffic is encrypted and small in size. The incident handler suspects a malware infection with a beaconing mechanism. Which type of malware is most likely responsible for this behavior?

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

During a malware incident on a Windows Server 2019 host, an incident handler discovers that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' has been modified to run a binary from C:\Users\Public\svchost.exe every 15 minutes. The handler needs to preserve volatile evidence of this persistence mechanism before remediation. Which action should the handler take first?

You are analyzing a Windows malware sample and observe that it creates a new service with an ImagePath pointing to a file in the user's AppData folder. The service is configured with a generic display name resembling a legitimate Windows component. What is the primary purpose of this behavior?

An incident handler is analyzing a malware sample that uses process hollowing. The handler observes that a legitimate process, such as svchost.exe, is running but its memory contains malicious code. Which Windows API sequence is most characteristic of process hollowing?

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

A helpdesk technician reports that multiple users received an email with an attached PDF that, when opened, prompted them to enable macros. One user enabled macros and their workstation is now showing unusual outbound connections. As the incident handler, which action should you take FIRST according to the incident response lifecycle?

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

You are triaging a Windows workstation suspected of a malware infection. Several indicators suggest the malware is using the Windows Registry for persistence. Which TWO registry locations should you examine first to identify autostart entries created by the malware? (Choose two.)

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

A financial institution's incident response team is investigating a malware outbreak that encrypts files and demands payment. The team needs to identify the malware family to determine if a decryption tool is available. Which two characteristics should the team analyze to identify the ransomware family? (Choose two.)

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

You are investigating a suspected fileless malware incident on a Windows server. EDR telemetry shows that powershell.exe was spawned by winword.exe and executed an encoded command that downloaded a script from a remote host. The process has already exited. Which artifact is MOST likely to contain the decoded command and the URL contacted?

A helpdesk technician reports that a user's browser is redirecting searches to an unfamiliar site and displaying pop-up advertisements even when no browser is open. You suspect a potentially unwanted program or adware infection. Which initial step is most appropriate for an incident handler?

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

A finance workstation running Windows 10 begins displaying a full-screen message demanding Bitcoin payment and encrypts files with the .locky extension. The user reports the machine is still powered on and connected to the corporate network. As the incident handler, which action should you take FIRST to preserve volatile evidence?

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

A user reports that Microsoft Word documents on a shared drive are suddenly opening with a prompt to enable macros, and a new file named '~$invoice.docx' appears in the same directory. Analysis shows the macro contains the string 'AutoOpen' and references a remote template URL. Which malware category and delivery technique best describe this incident?

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

You are handling a malware incident on a Windows server and need to determine whether the malware has established persistence. Which two registry locations should you inspect first because they are the most common autostart points used by malware? (Choose two.)

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

A malware incident has been identified on a corporate workstation. The incident response team is following the containment, eradication, and recovery phases. Which TWO of the following actions are considered part of the eradication phase? (Choose two.)

A user's Windows 10 workstation is suspected of being infected with fileless malware that resides only in memory and executes PowerShell commands. The incident handler needs to capture volatile evidence from the system before it is powered off. Which tool is specifically designed for acquiring a memory dump from a Windows system?

An incident handler is reviewing a suspicious executable found on a compromised Windows system. The file has a double extension, such as 'invoice.pdf.exe'. Which type of malware delivery technique is this most likely an example of?

During a malware incident, you observe that a compromised system is communicating with a known command-and-control (C2) server at 203.0.113.45 over TCP port 443. You need to block this communication at the network perimeter to prevent further data exfiltration. Which action should you take?

An employee's Windows workstation is suspected of being infected with malware after clicking a link in a spam email. You need to identify which process is making outbound network connections to an external IP address. Which built-in Windows tool should you use to correlate active network connections with their owning processes?

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Which THREE of the following indicators are found in email-based malware delivery?

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

A malware incident has been contained and eradicated on an infected Windows server. Before returning the server to production, you need to verify that no malicious processes or unauthorized autostart entries remain. Which action best supports this validation?

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

An incident handler is analyzing a malware sample that appears to be a ransomware variant. The sample encrypts files with a specific extension and drops a ransom note. The handler wants to determine the encryption algorithm used to potentially find weaknesses. Which artifact from the malware analysis is most directly useful to identify the encryption algorithm?

During a malware incident investigation on a Windows 10 workstation, you discover a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' that launches 'C:\Users\Public\updater.exe' every 15 minutes. Legitimate Edge update tasks do not execute binaries from the Public profile. Which containment action best preserves volatile evidence while stopping the recurring malicious execution?

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?