312-50 Question 158
Single answer▪ Malware ConceptsDuring an internal security assessment, you are asked to analyze a suspected malware incident on a Windows workstation. The host shows periodic outbound connections to an unknown external IP, even when no user applications are open. A review of startup folders and standard Run registry keys shows nothing suspicious. However, the process reappears after termination and seems to be launched by a legitimate Windows process. Which malware technique most likely explains this behavior?
- A
A fileless malware infection using PowerShell or WMI for persistence and execution
- B
A polymorphic virus that changes its signature every time the system reboots
- C
A boot sector virus that infects the master boot record and launches after POST
- D
A ransomware payload that encrypts files and deletes itself after execution
Show answer and explanation
Correct answer: A
Explanation
The best answer is fileless malware. In real-world incidents, fileless malware often uses trusted native Windows components such as PowerShell, Windows Management Instrumentation (WMI), rundll32, regsvr32, or scheduled tasks to execute malicious logic and maintain persistence while minimizing artifacts on disk. This makes it harder to detect through basic checks like startup folders or common Run keys alone. Analysts should expand investigation to WMI event subscriptions, PowerShell logs, Scheduled Tasks, Sysmon telemetry, parent-child process relationships, network connections, and memory-resident artifacts. This aligns with common guidance from Microsoft security documentation, MITRE ATT&CK techniques related to PowerShell, WMI, and signed binary proxy execution, and general incident response best practices for living-off-the-land and fileless threats.
- A. Correct.
Correct. Fileless malware commonly abuses legitimate built-in tools such as PowerShell, WMI, scheduled tasks, or registry-based mechanisms to execute and persist without relying on obvious malicious files in startup locations. It can also be launched by legitimate parent processes, making it harder to detect with simple file- and autorun-based checks. This matches the scenario where the malware survives process termination, avoids standard Run keys and startup folders, and is associated with normal Windows components.
- B. Incorrect.
Incorrect. A polymorphic virus is characterized by changing its code or signature to evade signature-based detection, but that trait does not specifically explain persistence through legitimate Windows management components or the absence of suspicious startup entries. A polymorphic virus is still often file-based and does not inherently imply the observed execution pattern.
- C. Incorrect.
Incorrect. A boot sector virus infects the boot process, such as the master boot record or boot sector, and typically executes very early during system startup. While it can provide persistence, the scenario specifically points to malware being relaunched by a legitimate Windows process after boot and not by low-level boot infection indicators. Modern Windows systems with UEFI and Secure Boot also reduce the likelihood of classic MBR-focused malware in this exact form.
- D. Incorrect.
Incorrect. Ransomware is primarily identified by file encryption, ransom notes, and impact on data availability. The scenario instead describes stealthy recurring outbound communication and persistence through legitimate processes without mention of encryption activity. Although some ransomware families use stealth mechanisms, the described behavior is more consistent with fileless malware or a backdoor than with ransomware itself.