312-50V11 · Question #476
Matthew received an email with an attachment named "YouWon$10Grand.zip." The zip file contains a file named "HowToClaimYourPrize.docx.exe." Out of excitement and curiosity, Matthew opened the said fil
The correct answer is B. Trojan. The malware disguises itself as a benign file to trick the user into executing it, then persists and communicates with a command-and-control server - the defining characteristics of a Trojan horse.
Question
Matthew received an email with an attachment named "YouWon$10Grand.zip." The zip file contains a file named "HowToClaimYourPrize.docx.exe." Out of excitement and curiosity, Matthew opened the said file. Without his knowledge, the file copies itself to Matthew's APPDATA\IocaI directory and begins to beacon to a Command-and-control server to download additional malicious binaries. What type of malware has Matthew encountered?
Options
- AKey-logger
- BTrojan
- CWorm
- DMacro Virus
How the community answered
(52 responses)- A2% (1)
- B92% (48)
- C4% (2)
- D2% (1)
Why each option
The malware disguises itself as a benign file to trick the user into executing it, then persists and communicates with a command-and-control server - the defining characteristics of a Trojan horse.
A keylogger is specifically designed to silently record keystrokes to capture credentials; the described malware performs no keystroke capture and instead focuses on persistence and remote code download.
A Trojan horse deceives the user by masquerading as legitimate content (here, using a double extension trick - HowToClaimYourPrize.docx.exe - to appear as a document), then once executed it copies itself to a persistence directory (APPDATA\local) and beacons to a C2 server to pull down additional malicious payloads, all of which are hallmark Trojan behaviors.
A worm self-propagates across networks autonomously without requiring a user to be deceived into running it; this malware required the victim to manually execute the disguised file.
A macro virus embeds malicious VBA macros inside document files such as .docx that trigger on document open; this sample is a standalone executable that only mimics a document through its filename.
Concept tested: Trojan horse malware identification and behavior analysis
Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/trojans-malware
Topics
Community Discussion
No community discussion yet for this question.