Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A security analyst is conducting forensic triage on several compromised endpoints following an enterprise network incident. Match each observed technical Indicator of Compromise (IoC) with its corresponding malware classification.

  • Memory forensic analysis reveals Master Boot Record (MBR) modification and code execution prior to operating system kernel initialization.Bootkit
  • An automated process silently uses high system GPU resources to perform hashing operations while communicating via the Stratum protocol.Cryptominer
  • System logs show periodic HTTP POST requests containing encrypted keyboard inputs and clipboard buffers sent to an external C2 server.Spyware
  • Volatile memory inspection reveals WMI scripts executing encoded commands injected into legitimate system processes without creating executable files on disk.Fileless Malware

Answer

1. MBR modification prior to kernel load corresponds to Bootkit. 2. GPU hashing with Stratum protocol corresponds to Cryptominer. 3. Encrypted keystroke/clipboard exfiltration corresponds to Spyware. 4. In-memory WMI execution without disk binaries corresponds to Fileless Malware.
Each malware classification is accurately paired with its primary technical artifact: MBR manipulation indicates a Bootkit, unauthorized GPU hashing over Stratum indicates a Cryptominer, covert keystroke/clipboard exfiltration indicates Spyware, and RAM-only script execution using native OS tooling indicates Fileless Malware.

Step-by-Step Solution

1
Analyze item 1: Execution occurring before OS kernel initialization via MBR modification.
Identify that malware affecting boot sectors prior to OS load is classified as a Bootkit.
Bootkits target the storage boot sector to hijack boot sequence control before security software initializes.
2
Analyze item 2: High GPU utilization performing hashing using the Stratum protocol.
Identify that unauthorized resource consumption for cryptographic hashing matches Cryptominer behavior.
Cryptojacking malware leverages target hardware to compute cryptographic proofs for financial gain via Stratum mining pools.
3
Analyze item 3: Capturing keystrokes and clipboard data for periodic outbound transmission.
Identify that telemetry logging user inputs matches Spyware (keylogger/stealer) characteristics.
Spyware covertly monitors user behavior and harvests credentials or private data.
4
Analyze item 4: Execution strictly within memory using WMI without creating disk files.
Identify that living-off-the-land techniques executing in memory correspond to Fileless Malware.
Fileless malware avoids detection by traditional file-based antivirus scanners by running directly in RAM through legitimate host processes.

Key Concept

Malware Types and Indicators of Compromise
Estimated Time:2m 0s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic