CCT Digital Forensics & Malware Analysis 2

Question 1

What distinguishes dynamic malware analysis from static analysis?

Accepted Answer

Dynamic analysis executes the sample in a controlled environment to observe behavior

Answer

Dynamic analysis examines code without execution; static runs the sample

Answer

Dynamic analysis only works on scripts, not binaries

Answer

Dynamic analysis requires source code access

Question 2

A malware sample modifies the Windows registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. What is the likely purpose?

Accepted Answer

Establishing persistence so the malware survives reboots

Answer

Escalating privileges to SYSTEM

Answer

Exfiltrating data to a C2 server

Answer

Disabling Windows Defender

Question 3

Which sandbox tool is widely used for automated dynamic malware analysis and generates detailed behavioral reports?

Accepted Answer

Cuckoo Sandbox

Answer

Wireshark

Answer

Volatility

Answer

Autopsy

Question 4

A process injects code into explorer.exe to hide its presence. What technique is this?

Accepted Answer

Process injection

Answer

DLL side-loading

Answer

Process hollowing

Answer

Reflective loading

Question 5

Which Wireshark display filter would capture only DNS traffic for network forensics?

Accepted Answer

dns

Answer

tcp.port == 53

Answer

udp.port == 53

Answer

icmp.type == 53

Question 6

Malware uses domain generation algorithms (DGA) to communicate with its C2 server. What is the main benefit to the attacker?

Accepted Answer

Generating random domains daily to evade static blocklists

Answer

Encrypting all C2 traffic to prevent interception

Answer

Hiding the malware inside legitimate domains

Answer

Bypassing firewall rules by using port 80

Question 7

Which memory forensics framework is most commonly used to analyze RAM dumps and detect injected processes, hidden drivers, and network connections?

Accepted Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Answer

YARA