300-215 Question 74
Select 3During an investigation of a suspected malware infection on a Windows server, you are tasked with identifying and collecting critical files for analysis, including the malicious executable and relevant system logs. Which of the following files and their locations should you prioritize for collection?
- A
C:\Windows\System32\config\SAM
- B
C:\Windows\System32\drivers\etc\hosts
- C
C:\Users<Username>\AppData\Local\Temp\malicious.exe
- D
C:\Windows\System32\winevt\Logs\Security.evtx
- E
C:\Program Files\Common Files\System\msrpc.dll
- F
C:\Windows\Prefetch\MALICIOUS.EXE-12345678.pf
Show answer and explanation
Correct answers: C, D, F
Explanation
When conducting forensic analysis, it is essential to collect files that provide direct evidence of malicious activity and can help in reconstructing the timeline. Temporary files (e.g., executables in the Temp folder), event logs (e.g., Security.evtx), and Prefetch files are critical in identifying malware and understanding its behavior. Other files, such as SAM and msrpc.dll, are not immediately relevant unless the investigation scope explicitly requires them.
- A. Incorrect.
The SAM file is critical for password-related investigations but does not directly help with identifying malware or activity logs in this scenario.
- B. Incorrect.
The hosts file is used for DNS resolution overrides and might be relevant if DNS manipulation is suspected, but it is not critical for identifying malware or activity logs.
- C. Correct.
The Temp folder is a common location where malware stores its executables. Collecting this file is critical for analysis.
- D. Correct.
The Security.evtx log contains event data such as login attempts and process creation, which can help in identifying suspicious activity or correlating malware execution.
- E. Incorrect.
The msrpc.dll file is a system library and is not directly relevant to the malware investigation unless it has been explicitly identified as compromised.
- F. Correct.
Prefetch files help track execution of binaries on the system, including frequently executed malware. The presence of a malicious executable prefetch file can provide evidence of its execution.