312-50 Question 159
Single answer▪ Malware ConceptsDuring an internal security assessment, you discover a Windows workstation that repeatedly becomes infected even after the security team reformats the hard drive and reinstalls the operating system from a clean image. Shortly after each rebuild, unauthorized outbound connections resume before any user applications are installed. The team suspects a malware type designed to survive OS reinstallation by hiding outside the standard file system and boot process. Which malware type best explains this behavior?
- A
Polymorphic virus
- B
Fileless malware
- C
Rootkit
- D
Boot sector/UEFI firmware malware
Show answer and explanation
Correct answer: D
Explanation
The key clue is persistence after reformatting the hard drive and reinstalling the operating system from a known-good image. That strongly suggests malware operating below the OS level, such as boot sector malware or, more seriously, UEFI firmware malware. In real-world incident response, this kind of persistence requires responders to verify firmware integrity, update or reflash firmware from a trusted source, validate Secure Boot configuration, and rebuild from trusted media. Guidance from organizations such as CISA, NIST, and MITRE ATT&CK highlights boot and firmware-level compromise as a high-impact persistence technique because it can evade traditional file-based remediation. By contrast, polymorphic viruses focus on changing appearance, fileless malware emphasizes in-memory or living-off-the-land techniques, and rootkits focus on stealth within the OS; none of those alone best explains recurring compromise after a full disk reimage.
- A. Incorrect.
Incorrect. A polymorphic virus changes its code or signature to evade signature-based detection, but it typically still depends on infecting files or processes within the operating system. Reformatting the drive and reinstalling the OS from a clean image would usually remove it unless another persistence mechanism exists outside the OS.
- B. Incorrect.
Incorrect. Fileless malware often operates in memory and may leverage legitimate tools such as PowerShell, WMI, or registry-based persistence. While it can be stealthy and may leave limited artifacts on disk, a full drive reformat and clean OS installation would generally disrupt its persistence unless there is an external reinfection source or firmware compromise.
- C. Incorrect.
Incorrect. A rootkit is designed to hide malware or malicious activity by manipulating the operating system, kernel, drivers, or user-space components. Although rootkits can provide strong stealth and persistence, most standard rootkits residing on disk or in the OS are removed by a true wipe and reinstall. The scenario points to persistence below or outside the operating system itself.
- D. Correct.
Correct. Boot sector malware and especially UEFI firmware malware can survive operating system reinstallation because they persist in the system's boot components or firmware rather than in normal OS files. If the malware is embedded in the boot chain or firmware, rebuilding the machine from a clean disk image may not remove it, and malicious activity can resume immediately after startup. This matches the scenario of reinfection occurring before user applications are installed.