200-201 Question 214
Select 2You are reviewing the output of a malware analysis tool that operates as a detonation chamber. The report contains the following details:
- The malicious file attempted to connect to an external IP address on port 443.
- The file created a scheduled task for persistence.
- Registry keys were modified to disable antivirus software.
- Several encrypted files were created in a user directory.
Based on this information, which behaviors indicate that the file is likely ransomware?
- A
The file attempted to connect to an external IP address on port 443.
- B
The file created a scheduled task for persistence.
- C
Registry keys were modified to disable antivirus software.
- D
Several encrypted files were created in a user directory.
Show answer and explanation
Correct answers: C, D
Explanation
Ransomware typically exhibits certain behaviors, such as disabling security software to avoid detection and encrypting files to prevent the victim from accessing their data. While other actions like establishing external connections and creating persistence mechanisms are common among various malware types, they are not unique to ransomware. The encrypted files and registry modifications in this scenario are clear indicators of ransomware activity.
- A. Incorrect.
While connecting to an external IP address on port 443 could signal malicious behavior, it is not a definitive indicator of ransomware. Many legitimate applications also use HTTPS connections on port 443.
- B. Incorrect.
Creating a scheduled task for persistence is a common tactic used by various types of malware, but it is not specifically indicative of ransomware.
- C. Correct.
Modifying registry keys to disable antivirus software is a strong indicator of malicious intent, and it is often observed in ransomware attacks to prevent detection and mitigation.
- D. Correct.
The creation of encrypted files in a user directory is one of the hallmark signs of ransomware, as ransomware's primary function is to encrypt files and demand a ransom for their decryption.