Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A security monitoring tool flags multiple enterprise endpoints executing command-line instructions to disable the Volume Shadow Copy Service (`vssadmin delete shadows /all /quiet`) while concurrently generating high-volume disk write events that append custom file extensions to local documents. Which of the following malware types is most likely responsible for this activity?

  1. RansomwareAnswer
  2. B
    Trojan
  3. C
    Worm
  4. D
    Rootkit

Answer

Ransomware is the malware type characterized by file encryption and backup inhibition techniques like volume shadow copy deletion.
The combination of erasing volume shadow copies (`vssadmin delete shadows`) and rapid file modification with new extensions is a classic indicator of compromise (IoC) for ransomware. Attackers destroy local backups to force victims into paying a ransom for decryption keys.

Step-by-Step Solution

1
Analyze the observed command-line behavior
The command `vssadmin delete shadows /all /quiet` is designed to erase local system restore points and volume snapshots.
Attackers run this command specifically to inhibit system recovery.
2
Analyze file system activity indicators
Rapid high-volume disk writes appending custom file extensions signify payload encryption.
Cryptographic file modification combined with backup destruction points directly to ransomware extortion activity.

Key Concept

Ransomware Indicators of Compromise and Impact Behaviors
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic