350-201 Question 189
Select 3As a security analyst, you are tasked with analyzing a suspicious file that was flagged by your organization's Intrusion Detection System (IDS). You decide to use a sandbox environment for dynamic malware analysis. During the analysis, which behavior would most likely indicate the file is malicious?
- A
The file attempts to disable antivirus or endpoint protection software.
- B
The file executes a series of DNS requests to known malicious domains.
- C
The file loads a large number of benign system libraries without executing any suspicious activity.
- D
The file establishes an encrypted connection to an external command-and-control (C2) server.
- E
The file performs repetitive read and write operations to temporary files without network activity.
Show answer and explanation
Correct answers: A, B, D
Explanation
Dynamic malware analysis in a sandbox environment involves observing the behavior of a file in a controlled and isolated setting. Indicators such as attempts to disable security software, communication with known malicious domains, and connections to external command-and-control servers are strong signs of malicious intent. Benign operations, such as library loading or repetitive file I/O without network activity, are less likely to indicate malicious behavior on their own.
- A. Correct.
Malware often attempts to disable security software to avoid detection, which is a common indicator of malicious behavior.
- B. Correct.
DNS requests to known malicious domains are a strong indicator of malicious activity, as this is often used for communication with command-and-control servers.
- C. Incorrect.
Loading system libraries is not inherently suspicious unless accompanied by other malicious activity. This alone does not indicate malicious behavior.
- D. Correct.
Establishing an encrypted connection to an external server, especially a known command-and-control server, is a common behavior of malware.
- E. Incorrect.
Repetitive file operations without network activity could indicate benign or standard application behavior, not necessarily malicious activity.