A system administrator downloaded a third-party system maintenance utility disguised as a performance optimizer. Upon execution, the application created a persistent registry entry under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, established an encrypted outbound connection to an external IP address, and injected code into system processes to monitor keyboard inputs. Which of the following technical characteristics and indicators of compromise (IoCs) distinguish this threat as a Trojan with spyware capabilities rather than a self-propagating network worm? (Select TWO.)
- Requirement for user execution and reliance on disguised social engineering delivery rather than self-replicating across network vulnerabilitiesAnswer
- Unauthorized keylogging and process memory monitoring combined with outbound command-and-control (C2) session trafficAnswer
- CAutonomous network scanning and exploitation of unpatched remote service vulnerabilities to spread across adjacent subnets without user intervention
- DDeployment of network-level firewall filtering rules on the host to mitigate application-layer buffer overflow exploits
Answer
The correct indicators and characteristics are the requirement for user execution via social engineering delivery, and the presence of keyboard input monitoring combined with outbound command-and-control traffic.
Trojans are defined by their delivery method, which tricks users into executing malicious code masquerading as legitimate software. Spyware specifically focuses on collecting sensitive information such as keystrokes and process activity, transmitting it over outbound command-and-control channels. Both of these differentiate the scenario's malware from self-propagating worms.
Step-by-Step Solution
Key Concept
Distinguishing Malware Types (Trojan vs. Worm) and Identifying Telemetry IoCs