350-201 Question 191
Select 3You are investigating a suspicious file and decide to perform dynamic malware analysis using a sandbox environment. During the analysis, you observe that the file attempts to connect to an external IP address and modify system registry keys. What steps should you take to confirm the malicious behavior and gather additional insights?
- A
Capture and analyze the network traffic generated by the file within the sandbox environment.
- B
Check the hash of the file against known threat intelligence databases.
- C
Manually inspect the code of the file without using the sandbox.
- D
Enable system monitoring within the sandbox to track changes made to files, processes, and registry keys.
- E
Allow the file to execute outside the sandbox to observe its behavior in a live environment.
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively perform dynamic malware analysis using a sandbox, you should leverage tools and techniques that allow you to observe the file's behavior in a controlled environment. Analyzing network traffic, checking the file's hash against threat intelligence databases, and enabling system monitoring in the sandbox are critical steps to confirm the malicious behavior and collect detailed insights. Avoid executing the file outside the sandbox to prevent potential damage to the real environment.
- A. Correct.
Capturing and analyzing network traffic within the sandbox can provide insights into the file's external communication, such as command-and-control (C2) server connections or data exfiltration attempts.
- B. Correct.
Checking the file's hash against threat intelligence databases can help identify if the file is a known piece of malware, saving time and confirming its malicious nature.
- C. Incorrect.
Manually inspecting the file's code without using the sandbox is not practical or safe, as it may require reverse engineering expertise and could lead to accidental execution.
- D. Correct.
Enabling system monitoring within the sandbox allows you to track changes made to the system, such as file modifications, process creations, or registry changes, which are critical for understanding the file’s behavior.
- E. Incorrect.
Allowing the file to execute outside the sandbox is highly risky and not recommended, as it could compromise the live environment and lead to further spread of the malware.