3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A sandbox report shows a malware sample making DNS queries for 'update.legit-service.com' and then connecting to an IP address in a different country on port 8443. The report also shows the malware uploading a file named 'credentials.txt' to that IP. Which finding is the strongest indicator of data exfiltration?

   • AThe DNS query for 'update.legit-service.com'
   • BConnecting to an IP in a different country
   • CUsing port 8443
   • DUploading a file named 'credentials.txt' to an external IP
   Reveal Solution Discussion Select an answer first
2. 17application · medium · select all that apply

   A sandbox report for a malicious document contains the following items. Which items should be extracted as IOCs for detection? (Select all that apply.)

   • AThe file path where the payload was dropped
   • BThe sandbox's analysis duration
   • CThe document's author metadata
   • DThe IP address of the C2 server
   • EThe SHA-256 hash of the document
   Check answers Discussion Select an answer first
4. 18application · medium

   An analyst reviews a sandbox report for a malicious binary. The report lists the file's SHA-256 hash, several IP addresses contacted, a domain name, and a file path where the binary dropped a DLL. Which item from the report is most useful as a host-based IOC for detecting the malware on other endpoints?

   • AThe DLL file path
   • BThe SHA-256 hash of the binary
   • CThe domain name
   • DThe IP addresses contacted
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is reviewing a sandbox report that shows no malicious behavior, but the sample is known to be malicious from prior intelligence. The report indicates the sample checked for the presence of a specific USB drive and then terminated. Which conclusion is most accurate?

   • AThe sample is benign because it did not exhibit malicious behavior in the sandbox
   • BThe sample is a keylogger that only activates when a USB drive is inserted
   • CThe sample is likely a USB-propagating worm that requires a USB drive to activate its payload
   • DThe sandbox report is invalid because the sample did not run
   Reveal Solution Discussion Select an answer first
6. 20application · medium · select all that apply

   A sandbox report shows network activity from a suspicious process. Which findings are strong indicators of data exfiltration? (Select all that apply.)

   • AData sent over a non-standard port such as TCP 4444
   • BDNS queries to a domain that is known to be benign
   • CA single small DNS query to a popular website
   • DLarge amounts of data sent to an IP address in a country with no business presence
   • ERepeated HTTP POST requests to a file-sharing service
   Check answers Discussion Select an answer first