312-50 Question 167
Single answer▪ Virus and Worm ConceptsDuring an internal security assessment, you are asked to explain how a malware outbreak spread through a segmented corporate network in less than 20 minutes, even though users reported they had not opened suspicious email attachments. Logs show repeated scanning of TCP port 445 between workstations, followed by remote code execution on unpatched hosts. Which type of malware best explains this behavior?
- A
A file-infecting virus that requires a user to execute an infected program on each host
- B
A macro virus that spreads when users open infected office documents
- C
A network worm that self-propagates by exploiting SMB vulnerabilities on reachable systems
- D
A boot sector virus that spreads through infected removable media during system startup
Show answer and explanation
Correct answer: C
Explanation
The best answer is the network worm. In CEH, a core distinction is that a virus generally requires some form of host file, user action, or execution path to spread, whereas a worm is self-contained and self-replicates over networks by exploiting vulnerabilities or weak configurations. The scenario points to SMB activity over TCP 445 and rapid lateral movement across unpatched systems, both of which are classic worm indicators. Real-world examples include WannaCry, which propagated via the SMBv1 EternalBlue vulnerability (MS17-010), and Conficker, which also used network-based propagation techniques. From a defensive and assessment perspective, this highlights the importance of timely patch management, disabling legacy protocols where possible, network segmentation validation, and monitoring for east-west scanning behavior. Relevant guidance can be found in Microsoft security advisories for SMB vulnerabilities and general malware behavior guidance from NIST incident handling documentation such as NIST SP 800-61.
- A. Incorrect.
Incorrect. A file-infecting virus typically attaches itself to executable files and usually depends on user action or execution of an infected file to spread. The scenario specifically indicates rapid lateral movement without users opening attachments, which is more consistent with autonomous propagation rather than host-file infection.
- B. Incorrect.
Incorrect. A macro virus generally relies on users opening malicious documents and enabling macros in applications such as Microsoft Office. In this case, the key indicators are automated scanning of TCP port 445 and exploitation of unpatched systems, not document handling or user-triggered macro execution.
- C. Correct.
Correct. A network worm is designed to spread automatically across systems without requiring users to execute an infected file. The evidence of rapid propagation, SMB-related traffic on TCP port 445, and remote code execution on unpatched hosts strongly matches worm behavior, similar to historical outbreaks such as WannaCry and Conficker that leveraged network services for self-replication.
- D. Incorrect.
Incorrect. A boot sector virus infects the boot record or master boot record and commonly spreads via infected removable media or boot processes. It does not fit the observed pattern of host-to-host scanning over TCP port 445 and automated exploitation of a network service.