GCIA Malware Analysis and Behavioral Analysis 5

Question 1

A malware analyst detonates a sample and observes it enumerating HKLM\SOFTWARE\VMware, Inc.\VMware Tools. What is the malware checking for?

Accepted Answer

Virtual machine environment detection

Answer

Checking for VMware-specific registry keys is a common VM detection technique; if found, malware may alter or suppress its behavior to evade sandbox analysis.

Question 2

During behavioral analysis, a sample drops a DLL into C:\Windows\System32 with the same name as a legitimate DLL but slightly different (e.g., 'winscok.dll'). What technique is this?

Accepted Answer

Typosquatting/masquerading

Answer

Naming malicious files similarly to legitimate system DLLs (typosquatting) is a masquerading technique to blend in with normal system files.

Question 3

An analyst sees a malware sample making HTTP requests with a User-Agent string of 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)'. Why is this suspicious in 2024?

Accepted Answer

IE 6 on Windows XP is an anachronistic User-Agent unlikely to appear on modern systems

Answer

A User-Agent claiming to be Internet Explorer 6 on Windows XP is a hardcoded string that stands out because such systems are extremely rare on modern networks.

Question 4

Which behavioral indicator would most strongly suggest a rootkit is active on a Linux system during live forensics?

Accepted Answer

Discrepancies between /proc entries and kernel-level process lists

Answer

Rootkits hook kernel functions to hide processes; discrepancies between userland views (/proc) and raw kernel structures reveal the hooking.

Question 5

A GCIA analyst reviews Zeek (Bro) logs and finds a connection log showing a single long-duration session (12+ hours) with small periodic byte transfers. What C2 pattern does this match?

Accepted Answer

Beaconing with long sleep intervals

Answer

Long-duration connections with small, periodic data transfers are characteristic of slow beaconing, where malware checks in infrequently to evade anomaly detection.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Malware Analysis and Behavioral Analysis 5