Examining .NET Malware GREM Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst is tracing a .NET malware sample and finds a method that calls Registry.CurrentUser.CreateSubKey() and then sets a value to the full path of the current executable. The method is invoked from the entry point before any other malicious behavior. What is the most likely purpose of this code?

   • AIt establishes persistence by adding a run key that launches the malware at user logon.
   • BIt creates a mutex to prevent multiple instances of the malware from running.
   • CIt disables Windows Defender by modifying security settings in the registry.
   • DIt stores configuration data that the malware will read later during execution.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A .NET malware sample uses the System.Net.Http.HttpClient class to communicate with a command-and-control server. The analyst wants to identify the URLs the malware contacts. What is the most efficient static analysis technique?

   • AInspect the metadata tables for references to the HttpClient class.
   • BSearch the decompiled code for string literals that are passed to HttpClient methods like GetAsync or PostAsync.
   • CUse a debugger to set breakpoints on the HttpClient methods and capture the URL arguments at runtime.
   • DRun the sample in a sandbox and use a network monitor to capture the URLs it contacts.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which .NET feature allows malware to call native Windows API functions from managed code?

   • AP/Invoke
   • BLINQ
   • CReflection
   • DGarbage Collection
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which .NET API is commonly used by malware to detect if a debugger is attached?

   • ASystem.Environment.MachineName
   • BSystem.Diagnostics.Debugger.IsAttached
   • CSystem.IO.File.Exists
   • DSystem.Net.Dns.GetHostName
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A .NET malware sample uses the 'Microsoft.Win32.TaskScheduler' class to create a scheduled task that runs a PowerShell script. The task is configured to run with the highest privileges. What is the malware likely achieving, and what is a potential detection challenge?

   • ACode obfuscation; the scheduled task encrypts the malware's code.
   • BAnti-debugging; the scheduled task checks for debuggers.
   • CPersistence and privilege escalation; the scheduled task may be hidden from standard user views.
   • DData exfiltration; the scheduled task sends data to a remote server.
   Reveal Solution Discussion Select an answer first