An analyst is extracting indicators of compromise (IOCs) from a malicious macro. Which of the following should be extracted as IOCs? Select all that apply.

The file path where the macro writes a malicious executable.

The URL used in the macro to download a payload.

The registry key that the macro creates for persistence.

An analyst is analyzing a macro that uses multiple anti-analysis techniques, including checking for debugger presence and VM artifacts. The macro also uses a long sleep before executing its payload. The analyst needs to obtain the payload but has limited time. Which approach is most effective?

Wait for the sleep to finish and hope the anti-analysis checks pass.

Patch the macro to skip the sleep and anti-analysis checks, then run it in a VM.

Use a debugger to step through the code and manually bypass the checks.

Use a VBA emulator that ignores sleep and anti-analysis checks.

An analyst needs to safely execute a malicious macro to observe its behavior. The macro is known to use anti-VM techniques. Which approach is most appropriate?

Disable the network adapter and run the macro in a VM

Use a standard VM without any modifications to hardware identifiers

Run the macro on the analyst's primary workstation with macros enabled

Use a bare-metal analysis host with network simulation and system restore snapshots

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 3)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 11–15

11application · medium · select all that apply
An analyst is extracting indicators of compromise (IOCs) from a malicious macro. Which of the following should be extracted as IOCs? Select all that apply.
Select an answer first
12foundation · easy
Which VBA function is often used to execute a command or launch a process in a malicious macro?
Select an answer first
13expert · hard
An analyst is analyzing a macro that uses multiple anti-analysis techniques, including checking for debugger presence and VM artifacts. The macro also uses a long sleep before executing its payload. The analyst needs to obtain the payload but has limited time. Which approach is most effective?
Select an answer first
14foundation · easy
Which of the following is an example of a tool that can emulate or sandbox macro execution?
Select an answer first
15application · hard
An analyst needs to safely execute a malicious macro to observe its behavior. The macro is known to use anti-VM techniques. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 3)

Questions 11–15

An analyst is extracting indicators of compromise (IOCs) from a malicious macro. Which of the following should be extracted as IOCs? Select all that apply.

Which VBA function is often used to execute a command or launch a process in a malicious macro?

An analyst is analyzing a macro that uses multiple anti-analysis techniques, including checking for debugger presence and VM artifacts. The macro also uses a long sleep before executing its payload. The analyst needs to obtain the payload but has limited time. Which approach is most effective?

Which of the following is an example of a tool that can emulate or sandbox macro execution?

An analyst needs to safely execute a malicious macro to observe its behavior. The macro is known to use anti-VM techniques. Which approach is most appropriate?

Keep studying — Document and File Analysis