CCNA Malware Incidents Questions

Resource Monitor provides detailed real-time information about CPU, memory, disk, and network usage per process. It shows network connections and which process is using them, allowing the handler to identify the adware process and its communication. This is more comprehensive than Task Manager for correlating resource consumption with network activity, directly addressing the slow performance and pop-ups.

Unexplained outbound connections to unknown IP addresses indicate command-and-control beaconing or data exfiltration, a runtime behaviour rather than a static file signature. This makes it a behavioural indicator, distinguishing it from artefact-based detection such as file hashes or signatures.

Encoded PowerShell executes malicious instructions through a trusted, signed system binary, hiding intent in base64 and evading signature-based detection. This typifies Living off the Land, which abuses legitimate built-in tools rather than dropping custom malware, matching the EDR indicator described in the stem.

DGA domains are algorithmically generated and typically exhibit high entropy and poor reputation. Blocking such domains at the DNS resolver prevents resolution of future DGA domains without needing to know them in advance, effectively disrupting command-and-control communication. This is a proactive, scalable containment measure that does not rely on static blocklists and is appropriate for this scenario where the attacker rotates domains frequently.

Disconnecting the workstation from the network immediately stops the ransomware from communicating with its C2 server and prevents it from encrypting files on network shares or spreading to other systems. This is the first containment step to limit the scope of the incident. It also preserves the state for forensic analysis and potential decryption.

Fixed-interval connections with low jitter are a hallmark of automated beaconing, where malware sleeps for a set period before checking in with its C2 server. Legitimate applications typically exhibit variable timing driven by user activity or event-driven updates. Consistent periodicity, especially combined with other anomalies, strongly supports a C2 beaconing determination during network forensic analysis.

API hooking intercepts calls to system or library functions and redirects them to attacker-controlled code, letting malware hide files, registry keys or network activity while returning fabricated results. This manipulation of system calls defeats monitoring tools that rely on those APIs.

Process Explorer displays a process's loaded modules, including the DLL path, version and digital signature, directly satisfying the requirement to identify which DLLs a legitimate process has loaded. Its lower pane lists all DLLs and memory-mapped files, exposing the malicious DLL's location for removal or analysis.

DGA generates large volumes of pseudo-random domain names, so the malware cycles through many candidates until one resolves to a live command-and-control server. This defeats static blocklists, which can only enumerate known domains, directly satisfying the scenario's constraint of evading pre-compiled C2 blocklists.

Restoring to a sandbox or isolated VLAN lets you verify backup integrity and confirm malware is absent before production reconnection. This prevents reintroducing the infection or overwriting clean data, directly satisfying the stem's requirement for the most critical pre-restoration step.

Patching the exploited vulnerability closes the initial access vector, preventing immediate reinfection after cleaning. Eradication is incomplete if the entry point remains open, so remediation must include identifying the specific flaw and applying the vendor fix. This satisfies the stem's requirement to secure the entry point, not merely remove malware artefacts.

Process hollowing unmounts a legitimate executable's memory and injects malicious code into that reserved space, so the payload executes under a trusted process identity. This satisfies the scenario's requirement to conceal activity from the EDR solution, since monitoring sees a signed, benign parent rather than an unknown binary.

Writing to the Run key causes Windows to execute the listed program automatically at every user logon, so the malware survives reboots without any user action. This satisfies the persistence objective by embedding an autostart entry in the registry.

Task Scheduler allows programs to be executed at specific times or in response to events. Malware often creates scheduled tasks to maintain persistence. The presence of a suspicious executable in the Scheduled Tasks tab of Autoruns indicates that the malware is using Task Scheduler for persistence.

Isolating the host stops any lateral movement or command-and-control traffic, and capturing memory first preserves volatile artifacts such as injected code and running processes. Removing the scheduled task and quarantining the binary addresses the self-healing persistence mechanism that re-creates the Run key, so the malware cannot respawn after cleanup.

CreateRemoteThread starts a new thread inside another process's address space, typically after allocating and writing shellcode there, so the injected code executes under the target process's context — the classic mechanism for process injection and defence evasion.

A RAT is designed to maintain persistent, stealthy access to a compromised system, often using periodic beacons to a command-and-control server to check for instructions. The small, encrypted, hourly communication is a classic beaconing pattern used by RATs to avoid detection while maintaining control. This allows the attacker to issue commands or exfiltrate data on demand.

Filtering on ip.addr matches packets where the beaconing IP appears as either source or destination, isolating the command-and-control conversation from unrelated traffic. This display filter satisfies the need to narrow the capture to the infected host's external communications on port 443, letting you inspect beacon timing and payloads.

Exporting the scheduled task definition with schtasks /query /tn ... /xml captures the exact trigger, action, and run-as account configured by the attacker, which is volatile because the task may be deleted or altered during remediation. This preserves the persistence mechanism's configuration for later analysis and legal purposes without executing the malicious binary.

Creating a Windows service with an ImagePath in a user-writable directory allows the malware to run automatically when the system boots, achieving persistence. The deceptive display name helps it blend with legitimate services. This is a common persistence technique that survives reboots and often runs with SYSTEM privileges if the service is configured accordingly, making it a high-value indicator for incident handlers.

Process hollowing involves creating a new process in a suspended state, unmapping its original code (ZwUnmapViewOfSection), allocating new memory, writing malicious code, setting the thread context to point to the new code, and resuming the thread. This sequence is the hallmark of process hollowing, allowing the malware to masquerade as a legitimate process.

Malicious scripts frequently store payloads as encrypted or encoded strings that are decrypted at runtime. Identifying the decryption routine and extracting the embedded strings reveals the concealed commands, exposing the script's true behaviour without executing it.

Magnet RAM Capture is a free Windows tool that acquires a full physical memory image, capturing volatile artefacts such as running processes, network connections and injected code. It satisfies the requirement to dump memory on the infected Windows host before the machine is wiped.

Handle, from Sysinternals, enumerates open handles per process, including named mutexes. Running handle.exe with a search string reveals which process holds the mutex, satisfying the requirement to identify the mutex name on the infected host.

Isolating the workstation is the immediate containment step that stops any further command-and-control traffic, lateral movement, or data exfiltration while preserving volatile evidence. This aligns with the incident response lifecycle, where containment follows detection and precedes eradication, and it protects other systems before deeper analysis begins.

Blocking propagation ports at the firewall severs the worm's transmission vector, halting lateral spread across the network. This containment action directly satisfies the stem's demand for the most immediate step, since the worm relies on open ports to reach new hosts. Patching or scanning takes longer and lets the infection continue.

The Services key stores configuration for Windows services, and malware often installs a malicious service here to gain persistence and run with SYSTEM privileges at boot. Reviewing service entries for unusual ImagePath values or recently created services helps identify this common and stealthy persistence mechanism.

Restricting the backup service account's permissions limits what that account can reach, so ransomware running under it cannot delete or encrypt backup repositories. This least-privilege control satisfies the stem's requirement to protect backups from ransomware encryption.

Ransomware families often use specific file extensions for encrypted files, such as .locky, .cerber, or .ryk. These extensions are a key indicator for identifying the family. By examining the extension, the team can quickly narrow down the ransomware variant and check if a known decryption tool exists. This is a standard first step in ransomware identification.

Physically unplugging the cable severs all network communication instantly, satisfying immediate isolation, while the workstation stays powered so volatile memory and running processes remain intact for later forensic capture. Wireless or software-based blocking risks missing alternate paths or triggering shutdown.

When script block logging is enabled, PowerShell writes event ID 4104 to the Microsoft-Windows-PowerShell/Operational log, capturing the actual script text after decoding. This reveals the deobfuscated command and any embedded URL, even though the process has exited, making it the most reliable artifact for reconstructing the fileless execution chain.

Capturing volatile data first preserves process lists, network connections, loaded modules, and browser extension details that disappear on reboot or cleanup. This evidence lets the handler identify the adware family, its persistence mechanism, and any command-and-control endpoints, which informs scoping and ensures eradication is complete rather than superficial.

Process Explorer integrates a VirusTotal lookup: selecting the process and choosing Options > Check VirusTotal submits the executable's hash to the service and returns its reputation, letting you assess the file before isolating the host.

PEview parses the Portable Executable structure and displays section headers, letting the analyst spot anomalies such as non-standard section names, high entropy, or unusual raw sizes that indicate packing. It directly addresses the need to inspect section headers.

The condition section with the OR operator evaluates both string identifiers, matching the file when either $a or $b is found. This satisfies the requirement to detect files containing the hex string or the string value.

Volatile data in RAM, including running processes, network connections, and possibly encryption keys, will be lost on shutdown or reboot. Capturing a live memory dump first preserves this evidence while the machine is still powered on. This aligns with the order of volatility principle and supports later malware analysis and potential decryption.

A vulnerability scan verifies that the restored systems contain no residual exploitable weaknesses, such as unpatched software the malware leveraged, before they are reconnected to production. This confirms the environment is safe and prevents immediate reinfection during recovery.

The AutoOpen macro combined with a remote template URL is the signature of remote template injection, where a benign-looking document loads a malicious template from an attacker-controlled server, delivering macro code without embedding it in the original file. The '~$' lock file confirms an active Word session and is consistent with this document-based delivery technique.

Calculating the hash preserves volatile evidence before the suspicious file in the Temp folder is altered or deleted, satisfying the need to establish integrity for later comparison against threat intelligence. Hashing is non-destructive, so it captures a unique fingerprint without modifying the artefact, unlike opening or executing it.

Beaconing is a hallmark of command-and-control traffic: compromised hosts contact the same external IP at regular intervals to poll for instructions. The predictable periodicity distinguishes it from ordinary browsing and satisfies the stem's request for commonly observed C2 indicators.

The HKLM Run key is one of the most frequently abused autostart locations because entries here execute at system startup for all users, giving malware high-privilege persistence without requiring a scheduled task or service. Inspecting it early reveals obvious load points and often identifies the dropped binary path, which then guides broader scoping and eradication efforts.

WinPmem is a Windows-compatible memory acquisition driver that captures physical RAM to a forensic image without altering running processes. It satisfies the live forensics constraint by preserving volatile evidence on an active workstation before shutdown destroys it.

EDR logs capture endpoint process, file and network telemetry, giving concrete artefacts such as hashes, command lines and C2 addresses for IoC extraction. This satisfies the need for host-level evidence tied to observed malicious activity, unlike policy documents or asset inventories.

Applying security patches can be part of eradication if the malware exploited a vulnerability. Patching the vulnerability removes the initial infection vector and prevents re-infection. It is a proactive step to eliminate the root cause and harden the system against the same attack.

WinPmem is a memory acquisition tool specifically designed for Windows systems. It can capture physical memory (RAM) to a file, preserving volatile data such as running processes and injected code. This makes it ideal for capturing evidence of fileless malware that exists only in memory before the system is shut down.

Masquerading involves disguising a malicious file as a legitimate or benign one. Using a double extension like 'invoice.pdf.exe' exploits the default Windows setting that hides known file extensions, making the file appear as a PDF document. This is a classic masquerading technique to trick users into executing malware. It is a specific type of deception focused on file appearance.

Blocking outbound traffic to the C2 server's IP address on the specific port prevents the compromised system from communicating with the C2 server. This effectively stops data exfiltration and further command execution. It is the most direct and immediate action to sever the connection at the network perimeter.

The netstat -ano command lists all active connections with their numeric addresses, ports, and owning process IDs (PIDs). By matching the PID to a process in Task Manager or tasklist, the handler can identify which executable is connecting to the external IP. This is a fast, built-in method for correlating network activity with processes during a live malware investigation.

Re-imaging infected workstations removes the root cause by rebuilding the compromised host from a trusted image, eliminating malware, persistence mechanisms and unauthorised changes. This satisfies eradication's goal of eliminating the threat before recovery, rather than merely containing or documenting the incident.

Embedded hyperlinks whose anchor text or display differs from the actual href target conceal the true destination, directing recipients to attacker-controlled domains. This obfuscation is a hallmark of phishing and malware delivery, satisfying the question's requirement for an email-based delivery indicator.

Constrained Language Mode restricts PowerShell to a safe subset, blocking the .NET reflection and dynamic invocation APIs that fileless malware abuses to run in memory. This hardening prevents script-based payloads from executing without touching disk.

md5sum computes the MD5 message digest of the specified file and prints the 128-bit hash alongside the filename, giving an integrity value for comparison against known-good or threat-intelligence hashes. It is a standard coreutils utility present on virtually all Linux distributions.

Comparing current system state against a documented baseline reveals unauthorized autostart entries, rogue services, suspicious scheduled tasks, and unexpected processes. This manual validation catches persistence mechanisms that signature-based tools may miss. It directly addresses the need to confirm eradication before returning the server to production and supports accountability in the incident response process.

The Services registry key under CurrentControlSet stores service definitions, including auto-start entries that malware abuses to launch at boot. Its presence in this hive is a recognised persistence indicator, satisfying the question's request for a registry-based persistence location.

The Received header records each mail transfer agent hop, with the originating server listed bottom-up. Examining these entries reveals the true sending IP and relay path, which the From header can spoof, making it the key field for tracing origin.

Disassembling the encryption routine allows the handler to see the exact cryptographic APIs and constants used, such as AES, RSA, or Salsa20. By examining the code flow and calls to Windows CryptoAPI or custom implementations, the algorithm can be identified with high confidence. This is the most direct and reliable method to determine the encryption algorithm and assess potential weaknesses.

Disabling the task halts the recurring execution of the masquerading binary without destroying the running process or its volatile memory, and the subsequent memory capture preserves injected code, network sockets, and encryption keys that would be lost on reboot. This satisfies containment while retaining evidence needed for root-cause analysis and scope determination.

Firewall logs record permitted outbound connections with source, destination IP and port, so they reveal which external address received the exfiltrated traffic. Host-based logs show local activity but rarely the external destination, and application logs lack network detail.

An incident log records each action, timestamp and decision taken by the response team during the malware incident, providing the chronological audit trail needed to demonstrate accountability and support later review or legal proceedings. It satisfies the stem's accountability and action-tracking requirement.