During an incident response, an analyst finds that a malware sample uses a legitimate Windows service to download a payload from a remote server. The payload then creates a user account and adds it to the local administrators group. Which two stages of the malware lifecycle are demonstrated?

Command-and-control and exfiltration

Initial infection and persistence

Payload delivery and privilege escalation

EC-CouncilEthical Hacking Essentials

Domain 2Objective 1

Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 3)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

43questions here

9free pages

6concepts

Questions 11–15

11application · medium
A forensic analyst is reviewing a compromised system and finds that several system files have been replaced with modified versions that have different hashes. The analyst also notices that the system's event logs have been cleared. Which indicator of compromise (IoC) is most directly related to the modified system files?
Select an answer first
12application · medium
A company's web server is compromised. The security team finds that the server is hosting a malicious script that redirects visitors to a drive-by download site. Which attack vector is being used to deliver malware to the website's visitors?
Select an answer first
13application · medium
A user receives an email that appears to be from a trusted colleague, with an attachment named 'invoice.exe'. When the user opens the attachment, the system becomes infected with malware that encrypts all files and displays a ransom note. Which type of malware is this?
Select an answer first
14expert · hard
During an incident response, an analyst finds that a malware sample uses a legitimate Windows service to download a payload from a remote server. The payload then creates a user account and adds it to the local administrators group. Which two stages of the malware lifecycle are demonstrated?
Select an answer first
15expert · hard
A security analyst is tracing a malware infection. The initial infection occurred via a spear-phishing email. The malware then downloaded a second-stage payload from a compromised website. The second-stage payload used a previously unknown vulnerability to gain administrator privileges and then installed a driver to maintain persistence. Which stage of the malware lifecycle is represented by the use of the previously unknown vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 3)

Questions 11–15

A company's web server is compromised. The security team finds that the server is hosting a malicious script that redirects visitors to a drive-by download site. Which attack vector is being used to deliver malware to the website's visitors?

A user receives an email that appears to be from a trusted colleague, with an attachment named 'invoice.exe'. When the user opens the attachment, the system becomes infected with malware that encrypts all files and displays a ransom note. Which type of malware is this?

During an incident response, an analyst finds that a malware sample uses a legitimate Windows service to download a payload from a remote server. The payload then creates a user account and adds it to the local administrators group. Which two stages of the malware lifecycle are demonstrated?

Keep studying — Malware and Password Attacks