CHFI Malware Forensics 2 — Questions and Answers
Question 1: A forensic analyst discovers a Windows process with no parent process ID and an unusual network connection to a foreign IP. Which technique best describes what the malware is likely using?
- Process hollowing (Correct answer)
- DLL side-loading
- Orphan process injection
- DKOM rootkit hiding
Correct answer: Process hollowing
Process hollowing replaces a legitimate process's code with malicious code, often resulting in a process that appears legitimate but has anomalous network behavior and no normal parent.
Question 2: During malware analysis, you observe that the sample reads from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. What capability does this suggest?
- Persistence via debugger hijacking (Correct answer)
- Registry-based keylogging
- UAC bypass technique
- DLL search order hijacking
Correct answer: Persistence via debugger hijacking
The Image File Execution Options (IFEO) registry key can be abused to redirect execution of a target program to a malicious binary using the Debugger value.
Question 3: A ransomware sample generates a unique key per victim and sends it to a C2 server before encrypting files. If the C2 is taken down before the key is transmitted, what is the most likely forensic implication?
- Decryption may be possible from memory artifacts (Correct answer)
- The ransomware will fail to encrypt any files
- The encryption key is permanently lost
- Backup shadow copies will remain intact
Correct answer: Decryption may be possible from memory artifacts
If the key was generated in memory before transmission, forensic memory analysis may recover it from RAM dumps or hibernation files before it is overwritten.
Question 4: Which artifact would BEST help an investigator determine whether a rootkit has been hiding files on an NTFS volume?
- Comparing $MFT entries with directory listings from a clean OS (Correct answer)
- Reviewing Windows Event Log ID 4688
- Analyzing Prefetch files for hidden binaries
- Checking the registry hive HKLM\SYSTEM\CurrentControlSet\Services
Correct answer: Comparing $MFT entries with directory listings from a clean OS
Discrepancies between the raw $MFT (Master File Table) and what the running OS reports can reveal files hidden by a rootkit intercepting directory enumeration calls.
Question 5: An investigator notices that a malware sample modifies the SSDT (System Service Descriptor Table). This is an indicator of which malware category?
- Kernel-mode rootkit (Correct answer)
- User-mode RAT
- Fileless malware
- Polymorphic virus
Correct answer: Kernel-mode rootkit
Modifying the SSDT to redirect system calls to malicious routines is a classic kernel-mode rootkit technique used to hide processes, files, and network connections.
Question 6: During behavioral analysis in a sandbox, a malware sample calls CreateRemoteThread targeting explorer.exe. What is the malware most likely attempting?
- Process injection to evade detection (Correct answer)
- Privilege escalation to SYSTEM
- Establishing a reverse shell listener
- Deleting Volume Shadow Copies
Correct answer: Process injection to evade detection
CreateRemoteThread is a common process injection API that injects and executes malicious code within the address space of a legitimate host process like explorer.exe.
Question 7: A CHFI investigator is analyzing a Linux system for malware. Which command would help identify shared libraries that have been hijacked via LD_PRELOAD?
- cat /proc/<pid>/maps | grep .so (Correct answer)
- lsmod | grep suspicious
- netstat -tulnp | grep LISTEN
- find / -name '*.ko' -newer /boot
Correct answer: cat /proc/<pid>/maps | grep .so
Reviewing /proc/<pid>/maps reveals all mapped memory regions including shared libraries, allowing detection of unexpected .so files injected via LD_PRELOAD.
CHFI Malware Forensics 2
A forensic analyst discovers a Windows process with no parent process ID and an unusual network connection to a foreign IP.
Which technique best describes what the malware is likely using?