During analysis of a .NET malware sample, the analyst discovers a method that writes a value to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. The method also uses the .NET 'Microsoft.Win32.Registry' class. What is the malware likely achieving?

Persistence by ensuring the malware runs at user logon.

Privilege escalation by modifying a system registry key.

Anti-analysis by disabling security tools through registry modifications.

Data exfiltration by storing stolen credentials in the registry.

A .NET malware sample has an entry point that calls a method named 'Initialize'. The 'Initialize' method calls 'LoadConfiguration', which reads a file, and then calls 'ExecutePayload'. The analyst wants to understand the order in which these methods are called. Which tool or technique is most appropriate?

Use a hex editor to search for the method names in the binary.

Use a PE viewer to examine the import table.

Use dnSpy to set a breakpoint on each method and step through the code during execution.

Use a disassembler to view the native code of the entry point.

A .NET malware sample uses the Microsoft.Win32.TaskScheduler library to create a scheduled task that runs the malware at system startup. The analyst wants to identify this persistence mechanism statically. Which approach is most effective?

Search the binary for strings like 'schtasks' or 'TaskScheduler' to confirm the use of the library.

Use a process monitor to observe registry or file system changes related to task creation.

Run the sample in a sandbox and check the Windows Task Scheduler for newly created tasks.

Inspect the metadata tables for references to TaskScheduler types and methods, then trace the code that creates the task.

A .NET malware sample uses a combination of anti-debugging and anti-VM techniques. The analyst has identified a method that checks for the presence of a debugger using 'Debugger.IsAttached' and another method that checks the system's BIOS for VM-related strings. The analyst wants to bypass both checks to analyze the malware dynamically. Which approach is most effective?

Run the malware on a physical machine without a debugger attached.

Use a tool like ScyllaHide to hide the debugger from the malware.

Patch both checks in the malware using a debugger, setting the relevant methods to return false.

Use a VM with a modified BIOS that does not contain VM-related strings.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 3)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 11–15

11application · medium
During analysis of a .NET malware sample, the analyst discovers a method that writes a value to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. The method also uses the .NET 'Microsoft.Win32.Registry' class. What is the malware likely achieving?
Select an answer first
12application · medium
A .NET malware sample has an entry point that calls a method named 'Initialize'. The 'Initialize' method calls 'LoadConfiguration', which reads a file, and then calls 'ExecutePayload'. The analyst wants to understand the order in which these methods are called. Which tool or technique is most appropriate?
Select an answer first
13expert · hard
A .NET malware sample uses the Microsoft.Win32.TaskScheduler library to create a scheduled task that runs the malware at system startup. The analyst wants to identify this persistence mechanism statically. Which approach is most effective?
Select an answer first
14expert · hard
A .NET malware sample uses a combination of anti-debugging and anti-VM techniques. The analyst has identified a method that checks for the presence of a debugger using 'Debugger.IsAttached' and another method that checks the system's BIOS for VM-related strings. The analyst wants to bypass both checks to analyze the malware dynamically. Which approach is most effective?
Select an answer first
15application · medium
An analyst is using a tool to inspect the metadata tables of a .NET malware sample. The analyst wants to identify all the external assemblies that the malware references. Which metadata table should the analyst examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Examining .NET Malware GREM Practice Questions (Page 3)

Questions 11–15

During analysis of a .NET malware sample, the analyst discovers a method that writes a value to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. The method also uses the .NET 'Microsoft.Win32.Registry' class. What is the malware likely achieving?

A .NET malware sample uses the Microsoft.Win32.TaskScheduler library to create a scheduled task that runs the malware at system startup. The analyst wants to identify this persistence mechanism statically. Which approach is most effective?

An analyst is using a tool to inspect the metadata tables of a .NET malware sample. The analyst wants to identify all the external assemblies that the malware references. Which metadata table should the analyst examine?

Keep studying — Advanced Malware Analysis