Behavioral Analysis Fundamentals GREM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of using an isolated virtual machine for malware behavioral analysis?

   • ATo allow the malware to access the internet without restrictions
   • BTo automatically generate a behavioral report without manual analysis
   • CTo prevent the malware from spreading to the host or other systems
   • DTo speed up the malware's execution for faster analysis
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is analyzing a piece of malware that is suspected of tampering with security settings. The analyst observes that the malware modifies the registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' and sets 'EnableLUA' to 0. What is the most likely purpose of this modification?

   • ATo set the system to automatically log on as the administrator.
   • BTo change the default firewall policy to block all incoming connections.
   • CTo enable Windows Defender and improve system security.
   • DTo disable User Account Control (UAC) and run with elevated privileges without prompting.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A malware analyst is reviewing an automated sandbox report for a sample that is suspected of data exfiltration. The report shows a DNS query for 'update.legit-service.com' followed by an HTTP POST to the same domain. Which additional observation in the report would most strongly indicate that this is C2 communication rather than a legitimate update check?

   • AThe HTTP response is a small JSON file with a version number.
   • BThe connection uses HTTPS with a valid certificate.
   • CThe DNS query was made only once during the entire analysis.
   • DThe HTTP POST contains a large amount of data that matches the contents of a local file.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is using Regshot to compare registry snapshots before and after running a malware sample. The comparison shows a new value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'Updater' with data 'C:\Users\Public\update.exe'. What is the most significant implication of this finding?

   • AThe malware has established a persistence mechanism that will execute 'update.exe' at user login.
   • BThe malware has modified the system's default browser settings to redirect the user to a malicious website.
   • CThe malware has installed a new Windows service that will start automatically.
   • DThe malware has added a scheduled task that runs 'update.exe' at a specific time.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is analyzing a malware sample that modifies the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe and sets the 'Debugger' value to 'C:\Windows\System32\cmd.exe'. What is the most likely purpose of this modification?

   • ATo add a persistence mechanism that runs cmd.exe at system startup.
   • BTo log all executions of notepad.exe to a file.
   • CTo enable debugging of notepad.exe by attaching a debugger.
   • DTo prevent notepad.exe from running by redirecting it to cmd.exe.
   Reveal Solution Discussion Select an answer first