Dynamic Malware Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During dynamic analysis, an analyst uses Process Monitor to log all registry and file system activity. After the malware runs, the analyst wants to identify which changes were made by the malware versus normal system activity. What is the most effective approach?

   • ACompare the Process Monitor log against a baseline log taken before the malware was executed.
   • BReboot the system and check for startup programs.
   • CUse Regshot to compare registry snapshots, ignoring file system changes.
   • DReview the entire Process Monitor log manually, looking for suspicious entries.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which network control is commonly used in a malware analysis sandbox to prevent malicious traffic from reaching the internet?

   • ADisabling the virtual network adapter or using a host-only network
   • BUsing a bridged network to give the VM a public IP address
   • CIncreasing the virtual machine's RAM
   • DEnabling file sharing with the host
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   While analyzing a ransomware sample in a VM, the analyst notices that the malware creates a service named 'LegitUpdate' and sets its start type to 'Automatic'. The analyst also sees that the malware modifies the 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' key. What is the most likely behavior being observed?

   • AAnti-analysis technique
   • BPersistence mechanism
   • CPrivilege escalation
   • DNetwork communication
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is analyzing a suspected data exfiltration malware. The malware is known to use HTTPS to communicate with a C2 server. The team has a sandbox VM with a host-only network and a proxy that can intercept HTTPS traffic. However, the malware checks for the presence of a proxy and refuses to run if it detects one. The team needs to observe the malware's network behavior. Which approach is most effective?

   • AForce the malware to use the proxy by modifying its configuration file.
   • BUse a bridged network adapter to allow the malware to communicate directly with the internet.
   • CDisable the proxy and run the malware without any network monitoring.
   • DUse a network tap on the host-only virtual switch and capture traffic without a proxy, then analyze the TLS handshake and SNI.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst has completed dynamic analysis of a worm that spreads via SMB. The analyst must write a report that includes the network indicators observed. Which network-related items should be included in the report?

   • AThe malware's mutex name and the processes it created.
   • BThe malware's file size and compilation timestamp.
   • CSource and destination IP addresses, ports used, and the SMB protocol versions observed.
   • DThe registry keys modified and the services created.
   Reveal Solution Discussion Select an answer first