Examkin

Question

Difficulty: EasyMalware Types and Indicators of Compromise

An Endpoint Detection and Response (EDR) agent alerts security personnel that files across a shared network drive are rapidly being encrypted and appended with a custom `.locked` file extension. In addition, a text file demanding payment in exchange for a decryption key has been placed in each affected directory. Which of the following malware types is most likely responsible for this activity?

  1. RansomwareAnswer
  2. B
    Worm
  3. C
    Trojan
  4. D
    Rootkit

Answer

Ransomware is the malware type responsible for encrypting files and placing ransom notes.
The correct answer is Ransomware because the defining characteristics of ransomware include unauthorized encryption of user or system files followed by extortion demands (such as ransom text files) detailing payment instructions to retrieve decryption capabilities.

Step-by-Step Solution

1
Analyze the technical indicators presented in the security alert.
Identified file encryption (addition of `.locked` extensions) and the presence of text files containing payment instructions for a decryption key.
These indicators directly align with data extortion tactics.
2
Correlate identified indicators of compromise (IoCs) with standard malware classifications.
Confirmed that malicious file encryption combined with financial extortion is the defining behavior of ransomware.
Other malware categories like worms, Trojans, or rootkits serve different primary functions such as self-replication, covert access, or stealth.

Key Concept

Ransomware Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic