Dynamic Malware Analysis

Which program would be used to take "snapshots" of the Windows registry before and after malware detonation and then compare the results to assist in finding host-based indicators for dynamic malware analysis?

• FakeNet

• ProcMon

• RegShot

• Autoruns

Which of the following tools is used to simulate the Internet in a Linux environment for dynamic malware analysis?

• Process Hacker

• Wireshark

• Internet Detective

• inetsim

What is the name of the package add-on that contains various tools in the analysis of malware such as tools from the sysinternals suite, FakeNet, and debuggers in Windows?

• OpenSource Analysis

• FlareVM

• Kali

• REMnux

It is very important to keep malware in a safe state until ready to detonate it. What is this state referred to?

• Defanged

• De-Armed

• Safe Mode

• Neutered

Inetsim keeps a log of network traffic. What is the name of this log?

• main.log

• services.log

• debug.log

• results.log

Which tool can be run along side an Internet simulator to monitor network based indicators?

• PE-Studio

• Floss

• Wireshark

• Autoruns

What method of analysis involves detonating malware to observe its behavior in real-time?

• Advanced Static Analysis

• Static Analysis

• Isolated Analysis

• Dynamic Analysis

Malware may be packed to obfuscate it's content. What is the name of a popular packing tool designed for this purpose?

• packlite

• upx

• ups

• packer

FakeNet-NG is one type of Internet Simulator. What Adapter type is required for it to run properly?

• Bridged

• Host-Only Adapter

• NAT

• Internal Network

A malware's mutex name can be found in which section in Process Explorer or Process Hacker?

• Handles

• Options

• System Information

• Services