CCE CCE Incident Response & Malware Analysis 2 — Questions and Answers
Question 1: During memory forensics, which Volatility plugin would a CCE examiner use to list running processes from a memory dump?
- imageinfo
- pslist or pstree (Correct answer)
- filescan
- dlllist
Correct answer: pslist or pstree
The 'pslist' and 'pstree' plugins in Volatility enumerate running processes from a memory image, revealing active and potentially malicious processes.
Question 2: What is process hollowing, and why is it significant in malware analysis?
- Creating a new legitimate process; significant for system performance analysis
- Injecting malicious code into a legitimate process's memory space by replacing its contents; used to evade detection (Correct answer)
- Terminating system processes to cause a denial of service; significant for availability analysis
- Duplicating a process in memory; significant for load balancing
Correct answer: Injecting malicious code into a legitimate process's memory space by replacing its contents; used to evade detection
Process hollowing involves starting a legitimate process, unmapping its code from memory, and replacing it with malicious code to evade security tools that whitelist trusted processes.
Question 3: Which Windows registry hive contains autorun entries most commonly abused by malware for persistence?
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
- HKEY_LOCAL_MACHINE\SAM\SAM\Domains
- HKEY_CLASSES_ROOT\CLSID
Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
The 'Run' and 'RunOnce' keys under HKCU and HKLM \Software\Microsoft\Windows\CurrentVersion are the most common registry locations malware uses to establish persistence.
Question 4: What is a 'rootkit' and how does it complicate digital forensic investigations?
- A type of ransomware that encrypts the root directory
- Malware that hides its presence by modifying OS structures to conceal files, processes, and network connections (Correct answer)
- A legitimate system administration tool used for root access
- A vulnerability scanner used by attackers
Correct answer: Malware that hides its presence by modifying OS structures to conceal files, processes, and network connections
Rootkits subvert OS functions to hide malicious activity, making standard tools return false information and requiring offline analysis or specialized tools to detect.
Question 5: During an incident response investigation, an examiner finds a PowerShell script with base64-encoded content. What is the most appropriate first step?
- Delete the script immediately as it is definitely malicious
- Decode the base64 content in an isolated environment to determine its purpose (Correct answer)
- Restart the affected system to clear the script from memory
- Ignore it as PowerShell encoding is always legitimate
Correct answer: Decode the base64 content in an isolated environment to determine its purpose
Base64 encoding in PowerShell is a common obfuscation technique; decoding it in an isolated environment reveals the actual commands being executed without risk.
Question 6: What is the primary purpose of a YARA rule in malware analysis and incident response?
- Encrypting forensic disk images
- Pattern matching to identify and classify malware based on textual or binary patterns (Correct answer)
- Monitoring network traffic in real time
- Automating patch deployment on infected systems
Correct answer: Pattern matching to identify and classify malware based on textual or binary patterns
YARA rules define patterns (strings, byte sequences, conditions) used to scan files and memory to identify and classify malware families across large datasets.
CCE CCE Incident Response & Malware Analysis 2
During memory forensics, which Volatility plugin would a CCE examiner use to list running processes from a memory dump?