3.6 Interpret the Output Report of Malware Analysis Tools Such as a Detonation Chamber or Sandbox 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team uses a sandbox to analyze a suspicious attachment. The sandbox report shows no malicious activity. The team suspects the sample is evasive. Which additional analysis step would be most effective in confirming the sample's malicious nature?

   • AReview the file's digital signature
   • BRun the sample in a sandbox with a simulated user profile and longer execution time
   • CDisable the sandbox's internet connection
   • DCheck the file's hash against a public malware database
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A sandbox report shows a sample that makes an HTTP POST to a legitimate-looking URL, but the POST data is encrypted with a custom algorithm. The destination IP is a known cloud provider. The analyst must decide whether this is C2 or benign. Which additional report detail would most strongly indicate C2?

   • AThe POST data contains a timestamp and a counter that increments with each request
   • BThe sample uses a hardcoded user-agent string that matches a known browser
   • CThe destination IP is in the same country as the company
   • DThe sample makes only one POST request during the entire analysis
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   A sandbox report shows repeated DNS queries to a domain that was registered only a few days ago and has no known legitimate use. What is the most likely interpretation?

   • AThe malware is using the domain for command-and-control communication
   • BThe malware is updating its virus definitions from a legitimate source
   • CThe malware is performing a denial-of-service attack on the domain
   • DThe malware is checking for internet connectivity to decide whether to run
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In a sandbox report, which of the following actions would be considered a suspicious registry modification?

   • AQuerying the installed software list from the registry
   • BCreating a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
   • CReading the system's current time from the registry
   • DEnumerating the network shares from the registry
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A sandbox report for a document macro shows that it created a file in the startup folder, modified the registry to disable macro security warnings, and then spawned PowerShell with a base64-encoded command. Which conclusion is best supported by this report?

   • AThe macro is likely a downloader that establishes persistence and executes a payload via PowerShell
   • BThe macro is a worm because it modifies the registry
   • CThe macro is benign but uses PowerShell for legitimate automation
   • DThe macro is a ransomware encryptor because it uses PowerShell
   Reveal Solution Discussion Select an answer first