CCE CCE Incident Response & Malware Analysis 2

Question 1

During memory forensics, which Volatility plugin would a CCE examiner use to list running processes from a memory dump?

Accepted Answer

pslist or pstree

Answer

The 'pslist' and 'pstree' plugins in Volatility enumerate running processes from a memory image, revealing active and potentially malicious processes.

Question 2

What is process hollowing, and why is it significant in malware analysis?

Accepted Answer

Injecting malicious code into a legitimate process's memory space by replacing its contents; used to evade detection

Answer

Process hollowing involves starting a legitimate process, unmapping its code from memory, and replacing it with malicious code to evade security tools that whitelist trusted processes.

Question 3

Which Windows registry hive contains autorun entries most commonly abused by malware for persistence?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

The 'Run' and 'RunOnce' keys under HKCU and HKLM \Software\Microsoft\Windows\CurrentVersion are the most common registry locations malware uses to establish persistence.

Question 4

What is a 'rootkit' and how does it complicate digital forensic investigations?

Accepted Answer

Malware that hides its presence by modifying OS structures to conceal files, processes, and network connections

Answer

Rootkits subvert OS functions to hide malicious activity, making standard tools return false information and requiring offline analysis or specialized tools to detect.

Question 5

During an incident response investigation, an examiner finds a PowerShell script with base64-encoded content. What is the most appropriate first step?

Accepted Answer

Decode the base64 content in an isolated environment to determine its purpose

Answer

Base64 encoding in PowerShell is a common obfuscation technique; decoding it in an isolated environment reveals the actual commands being executed without risk.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE CCE Incident Response & Malware Analysis 2