Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

A security monitoring tool flags multiple enterprise endpoints executing command-line instructions to disable the Volume Shadow Copy Service (`vssadmin delete shadows /all /quiet`) while concurrently generating high-volume disk write events that append custom file extensions to local documents. Which of the following malware types is most likely responsible for this activity?

  1. RansomwareCevap
  2. B
    Trojan
  3. C
    Worm
  4. D
    Rootkit

Cevap

Ransomware is the malware type characterized by file encryption and backup inhibition techniques like volume shadow copy deletion.
The combination of erasing volume shadow copies (`vssadmin delete shadows`) and rapid file modification with new extensions is a classic indicator of compromise (IoC) for ransomware. Attackers destroy local backups to force victims into paying a ransom for decryption keys.

Adım Adım Çözüm

1
Analyze the observed command-line behavior
The command `vssadmin delete shadows /all /quiet` is designed to erase local system restore points and volume snapshots.
Attackers run this command specifically to inhibit system recovery.
2
Analyze file system activity indicators
Rapid high-volume disk writes appending custom file extensions signify payload encryption.
Cryptographic file modification combined with backup destruction points directly to ransomware extortion activity.

Anahtar Kavram

Ransomware Indicators of Compromise and Impact Behaviors
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru