Examkin

Question

Difficulty: Very hardMalware Types and Indicators of Compromise

A security operations center (SOC) analyst is performing forensic triage on endpoints following an enterprise network intrusion. Analyze the host and network telemetry artifacts, and match each malware classification on the left with its corresponding technical indicator of compromise (IoC) artifact on the right.

  • Process Hollowing TrojanA legitimate executable file (such as svchost.exe) is launched in a suspended state, has its executable image unmapped from volatile memory, replaced with malicious code, and resumed under a target process context.
  • Network WormAutomated SMB port scanning across TCP 445 followed by rapid, unauthorized administrative share (IPC$) creation and automated payload execution across neighboring IP addresses without user interaction.
  • Kernel-Mode RootkitModification of System Service Descriptor Table (SSDT) function pointers in kernel memory to intercept system calls and hide specific malicious registry keys from OS API requests.
  • Fileless CryptominerA persistent WMI event subscription invoking an obfuscated PowerShell payload directly into memory using -EncodedCommand, driving sustained high CPU usage on legitimate processes without writing binaries to disk.

Answer

Process Hollowing Trojan matches the artifact describing a suspended legitimate process unmapped and reloaded with malicious code; Network Worm matches the artifact detailing automated SMB scanning and self-propagation across network shares; Kernel-Mode Rootkit matches the SSDT function pointer modification in kernel memory; Fileless Cryptominer matches the WMI event subscription executing obfuscated PowerShell payloads in memory.
Each malware category corresponds precisely to its forensic telemetry signature: Process Hollowing Trojans inject code into suspended process shells; Network Worms self-propagate across network protocols (SMB/TCP 445); Kernel-Mode Rootkits alter OS kernel data structures like the SSDT; and Fileless Cryptominers execute memory-resident scripts via WMI/PowerShell without writing files to disk.

Step-by-Step Solution

1
Analyze the first telemetry artifact involving process suspension and memory unmapping.
Identify this mechanism as process hollowing, a technique used by Trojans to conceal malicious execution inside a legitimate process shell.
Process hollowing relies on creating a process in a suspended state, hollowing out its PE headers and sections, and replacing them with a malicious image.
2
Examine the second telemetry artifact detailing SMB TCP 445 scanning and autonomous replication.
Classify this self-propagating behavior as a Network Worm.
Worms are distinguished from Trojans and viruses by their ability to self-replicate across network protocols like SMB without user interaction.
3
Review the third artifact involving SSDT function pointer modifications.
Match this indicator to a Kernel-Mode Rootkit.
SSDT (System Service Descriptor Table) hooking occurs exclusively in kernel memory (Ring 0) to hijack OS API calls and hide malware presence.
4
Evaluate the final artifact featuring WMI event subscriptions and memory-only PowerShell commands.
Link this artifact to a Fileless Cryptominer.
Using WMI and encoded PowerShell scripts enables malware execution entirely in RAM, avoiding disk creation while consuming system CPU resources.

Key Concept

Distinguishing Malware Telemetry Artifacts and Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic