Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

A security systems administrator analyzes a performance anomaly on an enterprise administrative jump host. System telemetry reveals an unverified process running from `C:\ProgramData\VendorApp\Temp\` that attaches hooks to Windows messaging queues via `SetWindowsHookEx`. Process analysis indicates that the application quietly records active window titles and raw keyboard entry sequences into an encrypted local buffer before exfiltrating the collected logs to a remote server over port 443. The host shows no evidence of automated network scanning, lateral propagation, or unauthorized driver installation. Which of the following malware types has infected the jump host?

  1. SpywareAnswer
  2. B
    Worm
  3. C
    Rootkit
  4. D
    Ransomware

Answer

Spyware
The observed malicious program hooks input interfaces (`SetWindowsHookEx`) to log user keystrokes and active application windows, storing them locally before transmitting them off-site over HTTPS. These telemetry artifacts are classic indicators of spyware (specifically keylogging capabilities), designed for covert data surveillance rather than system destruction or propagation.

Step-by-Step Solution

1
Analyze the observed system behaviors and indicators of compromise (IoCs).
The process hooks `SetWindowsHookEx` to record keystrokes, logs window titles, buffers input locally, and exfiltrates logs remotely over port 443.
Identifying the primary operational objective of the malware establishes its core category.
2
Evaluate propagation and stealth features described in telemetry.
No network replication (worm activity), driver hooking/kernel cloaking (rootkit activity), or file encryption (ransomware activity) is present.
Eliminating non-matching malware capabilities ensures accurate taxonomy classification.
3
Synthesize the IoCs into a standard malware classification.
Covert keylogging and surveillance telemetry directly match the operational definition of Spyware.
Spyware focuses specifically on gathering intelligence and exfiltrating user interaction data without host destruction.

Key Concept

Malware Indicators of Compromise (Spyware & Keyloggers)
Estimated Time:1m 30s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic