3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A sandbox report for a malicious executable shows that it creates a mutex named 'Global\UniqueMalwareMutex', writes a DLL to %SystemRoot%\System32\, and then registers the DLL as a Windows service. Which behavior is the strongest indicator of persistence?

   • ARegistering the DLL as a Windows service
   • BThe executable running in a sandbox
   • CCreating a mutex named 'Global\UniqueMalwareMutex'
   • DWriting the DLL to %SystemRoot%\System32\
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A sandbox report shows that the sample created a new executable file in the Windows Startup folder. How should an analyst interpret this behavior?

   • AThe malware is disabling security software to avoid detection
   • BThe malware is performing data exfiltration by copying files to an external drive
   • CThe malware is likely attempting to establish persistence by ensuring it runs at system startup
   • DThe malware is encrypting files for a ransomware attack
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A sandbox report shows a sample that creates a mutex named 'Global\MSUpdate', writes a file to %TEMP%, and then exits without any network activity. The analyst suspects the sample is a dropper that waits for a specific condition. Which additional report detail would most strongly support the dropper hypothesis?

   • AThe file in %TEMP% is a DLL that is loaded by a scheduled task created later in the report
   • BThe sample checked the system language and then exited
   • CThe mutex name matches a known legitimate application
   • DThe sample ran for only 30 seconds and then terminated
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When reviewing a sandbox report, which of the following would be considered a network-based indicator of compromise?

   • AThe domain name contacted by the malware
   • BThe mutex name created by the malware
   • CThe file path where the malware dropped a payload
   • DThe registry value set by the malware
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst submits a suspicious .exe to a sandbox. The report shows the file created a copy of itself in %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\ and then modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. No network connections were observed. Which conclusion is most strongly supported by the report?

   • AThe malware is a downloader that will fetch a payload later.
   • BThe malware is a ransomware that encrypts user files.
   • CThe malware establishes persistence and will likely execute on system reboot or user login.
   • DThe malware is a worm that spreads via removable media.
   Reveal Solution Discussion Select an answer first