3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is analyzing a malicious executable in a sandbox. The sandbox report shows that the executable modifies the Windows registry, creates a new file in the AppData folder, and makes an outbound connection to a remote server. Which sandbox feature is most important for capturing the outbound connection's destination?

   • ANetwork traffic capture that logs DNS queries and HTTP requests
   • BFile system monitoring that records all file creations and modifications
   • CProcess monitoring that tracks child processes and command-line arguments
   • DRegistry monitoring that logs all key changes
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A malware sample is known to check for the presence of a debugger and terminate if one is detected. The analyst wants to observe the malware's full behavior in the sandbox. Which sandbox configuration is most appropriate?

   • AUse a sandbox that can hide debugging artifacts, such as the presence of a debugger process or debug registers.
   • BIncrease the sandbox timeout to give the malware more time to execute.
   • CDisable network access to prevent the malware from downloading additional tools.
   • DRun the malware with a debugger attached to catch its exceptions.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A sandbox report for a malicious document shows that it uses a macro to download a second-stage payload from 'http://malicious.example.com/payload.exe'. The payload then creates a file named 'svchost.exe' in the user's AppData folder. The analyst wants to identify IOCs that can be used to detect this activity across the network. Which IOCs should be recorded?

   • AThe macro name and the URL
   • BThe URL 'http://malicious.example.com/payload.exe' and the file name 'svchost.exe'
   • CThe URL and the SHA-256 hash of the downloaded payload
   • DThe file name 'svchost.exe' and the AppData folder path
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst needs to analyze a suspicious executable that is known to detect virtual machines and refuse to run in sandbox environments. Which sandbox configuration is most likely to help the analyst observe the malware's behavior?

   • ADisable network access to prevent the malware from phoning home.
   • BRun the executable with a longer timeout to give it more time to execute.
   • CRun the executable in a sandbox with more memory and CPU resources.
   • DUse a sandbox that can disguise virtualization artifacts, such as CPU instructions, MAC addresses, and device names.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team needs to analyze a suspicious executable that is known to detect virtual machines and refuse to run in sandbox environments. The team wants to obtain useful behavioral IOCs. Which approach should they take?

   • AUse a sandbox with anti-evasion techniques, such as hiding virtualization artifacts and delaying execution
   • BRun the executable in a standard sandbox VM and accept that it may not execute
   • CUse static analysis only, since the malware will not run in a sandbox
   • DRun the executable on a physical machine with network monitoring
   Reveal Solution Discussion Select an answer first