200-201 Question 215
Select 3A cybersecurity analyst is reviewing the output of a malware detonation chamber tool. The report indicates the following observations:
- The malware attempts to connect to a suspicious IP address on port 8080.
- It creates a new registry key under 'HKEY_LOCAL_MACHINE\Software\MaliciousApp'.
- It drops an executable file named 'payload.exe' in the Windows temp directory. Based on this analysis, which actions should the analyst prioritize to mitigate the threat?
- A
Block outbound traffic to the suspicious IP address on port 8080
- B
Monitor the system for unauthorized registry key modifications
- C
Delete 'payload.exe' from the Windows temp directory
- D
Reconfigure the detonation chamber for additional sandboxing
- E
Perform a full system reinstallation to ensure no persistence mechanisms remain
Show answer and explanation
Correct answers: A, B, C
Explanation
The actions to block traffic to the suspicious IP, monitor for registry changes, and delete the dropped file directly address the observed malicious behaviors of the malware. These steps mitigate the threat effectively without resorting to extreme measures like full system reinstallation.
- A. Correct.
Blocking outbound traffic to the suspicious IP address on port 8080 will prevent the malware from communicating with its command-and-control (C2) server, disrupting its operation.
- B. Correct.
Monitoring for unauthorized registry key modifications is critical as the malware may use the registry for persistence or other malicious activities.
- C. Correct.
Deleting 'payload.exe' is necessary to remove the malicious file that was dropped by the malware and may be used to execute further malicious payloads.
- D. Incorrect.
Reconfiguring the detonation chamber is unnecessary in this scenario as the malware's behavior has already been successfully analyzed.
- E. Incorrect.
While performing a full system reinstallation might eliminate the malware, it is a drastic step that should only be considered if other mitigation measures fail.