Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are analyzing a memory image from a Windows host that was infected with ransomware. The ransomware encrypted files and then deleted itself. You need to identify how it achieved persistence so it can survive a reboot. Which memory artifact would you examine to find a persistence mechanism?

   • AThe Master File Table (MFT) from the disk image, because it shows deleted files.
   • BThe registry hives extracted from memory, specifically the Run and RunOnce keys.
   • CThe process's command line from the memory image, because it shows the original execution path.
   • DThe network connections in memory to identify the command-and-control server.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which approach is most appropriate for correlating multiple volatile artifacts to determine the order of malicious activities?

   • ACounting the number of processes running
   • BComparing file hashes of all executables
   • CUsing timestamps from process start times, network connection creation times, and registry key last-write times
   • DAnalyzing only the network connections
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are analyzing a memory image from a Windows host. You notice a process named 'powershell.exe' with a parent PID of 1234, which is the PID of a process that no longer exists. The command line is '-enc <base64 string>'. Which process analysis technique would best help you determine what the encoded command did?

   • ADecode the base64 string from the command line and analyze the resulting script.
   • BCheck the process's network connections to see if it communicated with a malicious IP.
   • CLook at the process's environment variables to find the script's path.
   • DExamine the process's memory for strings that match the base64 string.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A memory image from a compromised workstation shows a process 'powershell.exe' with an established connection to an external IP on port 443. The process's command line is 'powershell.exe -enc <base64>'. The analyst also finds a suspicious DLL loaded into the process. Which artifact is most indicative of the malware's command-and-control (C2) communication?

   • AThe process's command line with the encoded command
   • BThe suspicious DLL loaded into the process
   • CThe network connection to the external IP on port 443
   • DThe process name 'powershell.exe'
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   A forensic analyst is reconstructing the timeline of a data breach from a memory image. The analyst finds the following artifacts: (1) a process 'mimikatz.exe' running at 10:00, (2) an outbound connection to an external IP at 10:05, (3) a registry run key created at 10:10, and (4) a file 'C:\Users\Public\data.zip' created at 10:15. Which artifacts are most relevant for determining the scope of the breach? Select all that apply.

   • AThe registry run key
   • BThe outbound connection to an external IP
   • CThe file 'C:\Users\Public\data.zip'
   • DThe process 'mimikatz.exe'
   Check answers Discussion Select an answer first