A workstation with an IP address of 10.10.20.115/24 is suspected of being compromised. Which of the following is supported by the information in the process table?

The correct answer is B. The behavior of the minesweeper.exe process indicates a likely trojan horse infection. The parent process ID indicates that the smss.exe service was started by the minesweeper.exe process. This, together with the attempt of a remote connection to the Internet over port 80, would be more indicative of a trojan horse backdoor.

Malware Analysis & Advanced Persistent Threats

Question

Exhibit

Options

AA possibly compromised system at 10.10.10.200 is attempting to access shared files over the
BThe behavior of the minesweeper.exe process indicates a likely trojan horse infection
CThe behavior of the smss.exe process indicates a likely rootkit infection
DA possibly compromised system at 195.129.50.50 is attempting to start a web server on the host

How the community answered

(27 responses)

A
7% (2)
B
52% (14)
C
26% (7)
D
15% (4)

Explanation

The parent process ID indicates that the smss.exe service was started by the minesweeper.exe process. This, together with the attempt of a remote connection to the Internet over port 80, would be more indicative of a trojan horse backdoor.

Topics

#process table analysis#trojan detection#IOC analysis#host forensics

Community Discussion

No community discussion yet for this question.

Full GCIH Practice