CHFI Malware Forensics 3 — Questions and Answers
Question 1: A malware sample is found to create a service with a binary path pointing to a UNC path (\\server\share\evil.exe). What persistence mechanism does this represent?
- Remote service execution for lateral movement (Correct answer)
- DLL hijacking via UNC path
- Pass-the-hash persistence
- Token impersonation persistence
Correct answer: Remote service execution for lateral movement
Malware can create Windows services with UNC paths so that the payload is loaded from an attacker-controlled network share, enabling both persistence and lateral movement.
Question 2: During static analysis of a PE file, you find that the import table contains only LoadLibrary and GetProcAddress. What does this suggest?
- The malware dynamically resolves all API calls at runtime to evade static detection (Correct answer)
- The malware is packed and the real code is encrypted
- The sample is a benign helper DLL with minimal functionality
- The malware uses only kernel-mode APIs
Correct answer: The malware dynamically resolves all API calls at runtime to evade static detection
Using only LoadLibrary and GetProcAddress allows malware to resolve all needed APIs at runtime, making static import analysis ineffective for determining capabilities.
Question 3: A forensic examiner finds evidence of a malware using named pipes for inter-process communication. Which Windows Sysinternals tool would BEST enumerate active named pipes?
- PipeList (Correct answer)
- Process Monitor
- Autoruns
- TCPView
Correct answer: PipeList
PipeList from Sysinternals enumerates all named pipes on a Windows system, making it ideal for identifying malicious IPC channels used by malware.
Question 4: A banking trojan hooks the browser's SSL functions to capture plaintext credentials before encryption. What technique is this?
- Man-in-the-browser (MitB) attack (Correct answer)
- SSL stripping
- Session hijacking
- ARP poisoning
Correct answer: Man-in-the-browser (MitB) attack
MitB malware injects into the browser process and hooks SSL/TLS functions or form submission handlers to steal credentials before they are encrypted.
Question 5: Which tool would a CHFI investigator use to detect anti-forensic timestomping performed by malware on a Windows NTFS system?
- Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT (Correct answer)
- Checking Windows Event Log ID 4663
- Running sigcheck on the affected files
- Comparing file hashes against known-good databases
Correct answer: Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT
Timestomping modifies $STANDARD_INFORMATION timestamps but often leaves $FILE_NAME timestamps untouched, so comparing both MFT attributes reveals manipulation.
Question 6: A malware analyst is examining a sample that encrypts its C2 communications using a custom XOR cipher with a single-byte key. What analysis technique would MOST efficiently recover the key?
- Frequency analysis of the ciphertext (Correct answer)
- Running strings on the binary
- Entropy analysis of the binary sections
- Debugging the decryption routine in a sandbox
Correct answer: Frequency analysis of the ciphertext
Single-byte XOR encryption is vulnerable to frequency analysis because the most common byte in the plaintext (often 0x00 or 0x20 in protocols) reveals the key when XORed with the most frequent ciphertext byte.
Question 7: Which artifact from a Windows system BEST helps determine what files were recently accessed by malware running under a specific user account?
- NTUSER.DAT RecentDocs and OpenSave MRU keys (Correct answer)
- Event Log ID 4688 entries
- Prefetch file execution counts
- Amcache.hve entries
Correct answer: NTUSER.DAT RecentDocs and OpenSave MRU keys
The RecentDocs and OpenSave MRU registry keys in NTUSER.DAT record files recently opened or saved by the user account, revealing malware file access patterns.
CHFI Malware Forensics 3
A malware sample is found to create a service with a binary path pointing to a UNC path (\\server\share\evil.exe).
What persistence mechanism does this represent?