CCT Digital Forensics & Malware Analysis 2

Question 1

What distinguishes dynamic malware analysis from static analysis?

Accepted Answer

Dynamic analysis executes the sample in a controlled environment to observe behavior

Answer

Dynamic analysis detonates the malware in an isolated sandbox or VM to observe real-time behaviors such as file creation, registry changes, and network calls.

Question 2

A malware sample modifies the Windows registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. What is the likely purpose?

Accepted Answer

Establishing persistence so the malware survives reboots

Answer

The Run registry key causes listed programs to execute automatically at user logon, making it a common persistence mechanism for malware.

Question 3

Which sandbox tool is widely used for automated dynamic malware analysis and generates detailed behavioral reports?

Accepted Answer

Cuckoo Sandbox

Answer

Cuckoo Sandbox is an open-source automated malware analysis system that detonates samples and produces reports on file, network, and process activity.

Question 4

A process injects code into explorer.exe to hide its presence. What technique is this?

Accepted Answer

Process injection

Answer

Process injection involves inserting malicious code into the address space of a legitimate running process to evade detection and inherit its trust level.

Question 5

Which Wireshark display filter would capture only DNS traffic for network forensics?

Accepted Answer

dns

Answer

The 'dns' display filter in Wireshark specifically isolates DNS protocol traffic regardless of the transport layer, making it the most direct filter.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT Digital Forensics & Malware Analysis 2