A security analyst investigates an alert on an infected corporate workstation. Endpoint telemetry shows that a user executed a file disguised as a legitimate printer driver update. Immediately after execution, the process initiated automated network probes on port 445 (SMB) to spread to adjacent unpatched systems without further user intervention. Which of the following malware classifications or behaviors are demonstrated in this scenario? (Select TWO.)
- Trojan, because the malicious payload relied on tricking the user by masquerading as a legitimate updateAnswer
- Worm, because the malicious process automatically scans the local network to self-replicate across vulnerable hostsAnswer
- CLogic bomb, because the code remained dormant until activated by a specific system administrative event trigger
- DNetwork firewall rule modification, because host application code vulnerabilities can be corrected by closing SMB ports
Answer
The scenario demonstrates both Trojan malware delivery (masquerading as a legitimate printer driver update) and Worm self-propagation (automatically probing SMB port 445 to spread across network systems).
The scenario highlights two distinct malware traits: masquerading as benign software (printer driver update), which defines a Trojan, and active, automated network propagation via SMB port 445 to infect adjacent hosts, which defines a Worm.
Step-by-Step Solution
Key Concept
Distinguishing malware primary infection vectors (Trojans masquerading as legitimate files) from propagation mechanisms (Worms self-replicating over network ports).