Behavioral Analysis Fundamentals GREM Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A malware sample is being analyzed in a Windows 10 VM. The analyst takes a snapshot of the file system before execution. After running the sample for 10 minutes, the analyst compares the file system state and finds a new file at C:\Users\Public\Temp\svchost.exe. What is the most appropriate next step to determine if this file is a persistence mechanism?

   • ARun the file in a separate sandbox to observe its behavior.
   • BSearch the registry for a Run key or service entry that references this file path.
   • CCheck the file's creation time and compare it to the malware's execution time to confirm it was created by the sample.
   • DImmediately delete the file to prevent the malware from executing again.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   When interpreting an automated sandbox report, which finding is a common indicator of malware?

   • AThe sample created a shortcut on the desktop
   • BThe sample queried the system time
   • CThe sample modified the Windows hosts file
   • DThe sample opened a text file in Notepad
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A malware analyst has a packed binary that does not yield useful strings during static analysis. The analyst decides to perform dynamic analysis to observe the unpacked code's behavior. Which approach is most appropriate for this situation?

   • AUse a PE viewer to analyze the binary's sections and look for unusual section names.
   • BSubmit the packed binary to an automated sandbox and rely solely on the behavioral report.
   • CRun the binary in a debugger and set a breakpoint after the unpacking routine completes, then dump the process memory.
   • DUse a hex editor to search for the original import table in the packed binary.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An analyst is monitoring a malware sample and observes that it creates a new service named 'WindowsUpdate' with a binary path of 'C:\Windows\System32\svchost.exe -k netsvcs'. The analyst also notices that the service is set to start automatically. What is the most likely purpose of this service?

   • ATo provide a legitimate Windows update service.
   • BTo ensure the malware runs before other services.
   • CTo disguise the malware as a legitimate Windows service.
   • DTo allow the malware to run with system privileges.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An automated sandbox report for a malware sample shows a DNS query for 'update.example.com' followed by an HTTP POST to 'http://update.example.com/upload'. The report also shows that the malware reads a file named 'credentials.txt' before making the POST. Which conclusion is most strongly supported by this evidence?

   • AThe malware is likely exfiltrating the contents of 'credentials.txt' to the server.
   • BThe malware is checking for updates by querying the DNS server and then downloading a new version.
   • CThe malware is using the HTTP POST to download additional payloads from the server.
   • DThe malware is performing a DNS rebinding attack to bypass network restrictions.
   Reveal Solution Discussion Select an answer first