CHFI Malware Forensics 2

Question 1

A forensic analyst discovers a Windows process with no parent process ID and an unusual network connection to a foreign IP. Which technique best describes what the malware is likely using?

Accepted Answer

Process hollowing

Answer

Process hollowing replaces a legitimate process's code with malicious code, often resulting in a process that appears legitimate but has anomalous network behavior and no normal parent.

Question 2

During malware analysis, you observe that the sample reads from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. What capability does this suggest?

Accepted Answer

Persistence via debugger hijacking

Answer

The Image File Execution Options (IFEO) registry key can be abused to redirect execution of a target program to a malicious binary using the Debugger value.

Question 3

A ransomware sample generates a unique key per victim and sends it to a C2 server before encrypting files. If the C2 is taken down before the key is transmitted, what is the most likely forensic implication?

Accepted Answer

Decryption may be possible from memory artifacts

Answer

If the key was generated in memory before transmission, forensic memory analysis may recover it from RAM dumps or hibernation files before it is overwritten.

Question 4

Which artifact would BEST help an investigator determine whether a rootkit has been hiding files on an NTFS volume?

Accepted Answer

Comparing $MFT entries with directory listings from a clean OS

Answer

Discrepancies between the raw $MFT (Master File Table) and what the running OS reports can reveal files hidden by a rootkit intercepting directory enumeration calls.

Question 5

An investigator notices that a malware sample modifies the SSDT (System Service Descriptor Table). This is an indicator of which malware category?

Accepted Answer

Kernel-mode rootkit

Answer

Modifying the SSDT to redirect system calls to malicious routines is a classic kernel-mode rootkit technique used to hide processes, files, and network connections.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Malware Forensics 2