3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst reviews a sandbox report for a suspicious email attachment. The report shows the file created a copy of itself in %APPDATA%, added a Run registry key, and then spawned a process that made an HTTP POST to a remote IP. Which combination of report sections should the analyst prioritize to confirm the file is persistent and communicating externally?

   • AFile details, static analysis, and YARA signatures
   • BFile activity, process tree, and network connections
   • CNetwork connections, DNS requests, and HTTP traffic
   • DRegistry modifications, mutexes, and dropped files
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A sandbox report shows a malware sample making DNS queries for a domain that resolves to an IP address in a cloud provider. The sample then connects to that IP on port 443 and sends encrypted data. The report also shows the sample creating a scheduled task that runs a script every 5 minutes. Which finding is the strongest indicator of a C2 channel?

   • AThe DNS query for a domain that resolves to a cloud provider IP
   • BThe recurring scheduled task that runs every 5 minutes
   • CThe combination of a scheduled task and a persistent encrypted connection to a cloud IP
   • DThe encrypted connection to the IP on port 443
   Reveal Solution Discussion Select an answer first
4. 23expert · hard · select all that apply

   An analyst is evaluating the reliability of a sandbox report that shows no malicious activity for a known malicious sample. Which report observations would explain the false negative? (Select all that apply.)

   • AThe sample required user interaction such as clicking a button, which did not occur
   • BThe sample detected that it was running in a virtual machine and terminated
   • CThe sample ran for 5 minutes and then exited normally
   • DThe sample checked the system time and waited for a specific date to activate
   • EThe sample made a DNS query to a legitimate update domain
   Check answers Discussion Select an answer first
5. 24application · medium

   A sandbox report shows a binary that enumerates files with extensions .doc, .xls, .pdf, and .jpg, then attempts to connect to an external IP on port 21 (FTP). The binary also deletes the original files after the FTP transfer completes. Which malware category best matches this behavior?

   • AA keylogger that captures keystrokes
   • BA worm that spreads via email
   • CExfiltration-capable spyware or data thief
   • DRansomware that encrypts files
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A sandbox report for a suspicious document shows repeated DNS lookups for a domain that changes its IP address every few minutes, followed by HTTPS connections to those IPs on port 443. The document also created a scheduled task that runs a PowerShell script every hour. Which behavior is the strongest indicator of command-and-control communication?

   • AThe creation of a scheduled task to run PowerShell
   • BThe document being opened in a sandbox
   • CThe repeated DNS lookups to a domain with rapidly changing IP addresses
   • DThe use of HTTPS on port 443
   Reveal Solution Discussion Select an answer first