CCT Digital Forensics & Malware Analysis 2 — Questions and Answers
Question 1: What distinguishes dynamic malware analysis from static analysis?
- Dynamic analysis examines code without execution; static runs the sample
- Dynamic analysis executes the sample in a controlled environment to observe behavior (Correct answer)
- Dynamic analysis only works on scripts, not binaries
- Dynamic analysis requires source code access
Correct answer: Dynamic analysis executes the sample in a controlled environment to observe behavior
Dynamic analysis detonates the malware in an isolated sandbox or VM to observe real-time behaviors such as file creation, registry changes, and network calls.
Question 2: A malware sample modifies the Windows registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. What is the likely purpose?
- Escalating privileges to SYSTEM
- Establishing persistence so the malware survives reboots (Correct answer)
- Exfiltrating data to a C2 server
- Disabling Windows Defender
Correct answer: Establishing persistence so the malware survives reboots
The Run registry key causes listed programs to execute automatically at user logon, making it a common persistence mechanism for malware.
Question 3: Which sandbox tool is widely used for automated dynamic malware analysis and generates detailed behavioral reports?
- Wireshark
- Cuckoo Sandbox (Correct answer)
- Volatility
- Autopsy
Correct answer: Cuckoo Sandbox
Cuckoo Sandbox is an open-source automated malware analysis system that detonates samples and produces reports on file, network, and process activity.
Question 4: A process injects code into explorer.exe to hide its presence. What technique is this?
- DLL side-loading
- Process hollowing
- Process injection (Correct answer)
- Reflective loading
Correct answer: Process injection
Process injection involves inserting malicious code into the address space of a legitimate running process to evade detection and inherit its trust level.
Question 5: Which Wireshark display filter would capture only DNS traffic for network forensics?
- tcp.port == 53
- udp.port == 53
- dns (Correct answer)
- icmp.type == 53
Correct answer: dns
The 'dns' display filter in Wireshark specifically isolates DNS protocol traffic regardless of the transport layer, making it the most direct filter.
Question 6: Malware uses domain generation algorithms (DGA) to communicate with its C2 server. What is the main benefit to the attacker?
- Encrypting all C2 traffic to prevent interception
- Generating random domains daily to evade static blocklists (Correct answer)
- Hiding the malware inside legitimate domains
- Bypassing firewall rules by using port 80
Correct answer: Generating random domains daily to evade static blocklists
DGA dynamically generates many pseudo-random domain names, so defenders cannot block C2 by blacklisting a single domain — the attacker only needs to register one.
Question 7: Which memory forensics framework is most commonly used to analyze RAM dumps and detect injected processes, hidden drivers, and network connections?
- Autopsy
- FTK Imager
- Volatility (Correct answer)
- YARA
Correct answer: Volatility
Volatility is the industry-standard open-source memory forensics framework that can extract processes, network artifacts, and detect common evasion techniques from RAM images.
CCT Digital Forensics & Malware Analysis 2
What distinguishes dynamic malware analysis from static analysis?