Behavioral Analysis Fundamentals GREM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When is dynamic behavioral analysis most appropriate compared to static analysis?

   • AWhen the malware is heavily obfuscated and static analysis is difficult
   • BWhen you want to avoid executing the malware to prevent infection
   • CWhen you need to identify the compiler used to build the malware
   • DWhen you need to extract hardcoded strings from the binary
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which network activity is most indicative of command-and-control (C2) communication?

   • AAn HTTP request to a popular news website
   • BPeriodic connections to a domain that was registered recently and has no other traffic
   • CA continuous download of a large file from a legitimate software update server
   • DA single DNS query to a well-known search engine
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   During dynamic analysis, an analyst observes that a malware sample creates a file in the Windows directory, modifies a registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and then deletes the original executable. The analyst suspects the malware is using a fileless persistence technique. Which additional observation would most strongly support this hypothesis?

   • AThe registry value under the Run key points to a PowerShell command that downloads and executes a script from a remote server.
   • BThe malware modifies the hosts file to redirect traffic to a malicious server.
   • CThe file created in the Windows directory is a legitimate system file that was already present.
   • DThe malware creates a scheduled task that runs a script stored in the Windows directory.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team has received a suspicious executable from a client. The client wants to know if the executable will modify the system's hosts file. The team has limited time and needs a quick answer without setting up a full analysis environment. Which approach is most appropriate?

   • APerform static analysis by examining the executable's strings and imports for references to the hosts file.
   • BSet up a dedicated VM with Process Monitor and manually execute the sample to observe its behavior.
   • CAsk the client to run the executable on a test machine and report the results.
   • DRun the executable in an automated sandbox and review the file system activity in the report.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a malware sample that injects code into a legitimate process. The analyst observes that the target process 'explorer.exe' has a new thread that is not present in a clean baseline. The analyst also notices that the malware creates a new service named 'UpdateSvc' that points to a DLL in the System32 folder. Which behavior is most indicative of code injection?

   • AThe creation of the new service 'UpdateSvc'
   • BThe DLL in the System32 folder
   • CThe presence of a new thread in 'explorer.exe'
   • DThe malware's original process exiting after creating the service
   Reveal Solution Discussion Select an answer first