6.6 Recognize Patterns Such as an Enterprise-Wide File Infection Process to Determine the Root Cause or Source of the Infection CCFH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A file-encrypting malware has affected hosts in two different subnets. In subnet A, the first encrypted file was created by a process that ran under a user account. In subnet B, the first encrypted file was created by a process that ran under the SYSTEM account. What does this difference suggest?

   • AThe malware was deployed by a user in subnet A and by an administrator in subnet B.
   • BThe malware used different execution methods in each subnet, possibly due to different propagation techniques.
   • CThe malware is two different strains.
   • DThe malware in subnet B is more sophisticated than in subnet A.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing telemetry for a file-encrypting malware that has affected 100 hosts. The analyst notices that on every host, the malware process creates a file named 'RECOVER.txt' and then modifies the registry to add a run key. What does this pattern indicate?

   • AThe malware is a trojan that only affects specific files.
   • BThe malware is using a common persistence mechanism and leaving a ransom note.
   • CThe malware is a virus that infects other executable files.
   • DThe malware is a worm that spreads via removable media.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   In a file-encrypting malware investigation, you find that the first encrypted file on the initial host was created by a process that was spawned by a service on a remote server. The remote server is not infected. What is the most likely root cause?

   • AThe remote server is a file server that stored the malware.
   • BThe remote server is a DNS server that resolved a malicious domain.
   • CThe remote server was used as a jump box to execute the malware on the initial host.
   • DThe remote server is the command-and-control server.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are hunting for the source of a file-encrypting malware that has affected multiple hosts. You have identified a process that creates encrypted files on each host. Which additional telemetry would be most useful to pinpoint the initial execution?

   • AThe parent process of the malware on each host.
   • BThe amount of memory used by the malware process.
   • CThe user who logged in last on each host.
   • DThe file size of the encrypted files.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a hunt, you observe that on every affected host, the malware process creates a file named 'README.txt' in each user's Desktop folder before encrypting files. Which pattern does this represent?

   • AA legitimate software installation that creates documentation files.
   • BA common behavioral indicator of ransomware, creating a ransom note on each host.
   • CA sign of a worm that spreads via removable media.
   • DA targeted attack that only affects specific users.
   Reveal Solution Discussion Select an answer first