Malware Analysis and SysInternals

What are SysInternals?

• The literal, physical insides of your computer (E.G. Graphics Card, CPU, NIC)

• Tools for looking at the background workings of processes and applications

• An online Malware Repository

• Malicious progrms that should be avoided

What are the characteristics of STATIC Malware Analysis? (Choose all that apply)

• Executing a malware file in an isolated environment

• Reading a Malware Code to determine its behavior

• Using local or online tools to identify Malware

• The altering or fixing of a Malware code to eliminate threat

Which SysInternal tool moniters active TCP and UDP connections on an endpoint?

• TCPView

• PEStudios

• Procmon

• Autoruns

A detection Ratio on VirusTotal of 2/70 Is a definite indicator that a file or process is malicious

• True

• False

What are characteristics of DYNAMIC Malware Analysis? (Choose all that apply)

• Executing Malware in an Isolated environment to determine its behavior

• Reading a Malware code to determine its type and behavior

• Examining the behavior of Malware in an infected System

• Using online tools to determine a Malware's type and capability