Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Oefenen virussen > All > Flashcards

All Flashcards

Examen

1
Q

Motive Types cybercrime

A

Financial Gain
* Hacktivism
* Corporate Espionage
* Curiosity/Challenge
* Nation State-Sponsored Attacks
* Personal Vendetta

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Victim Types

A

Individuals
* Corporations/Businesses
* Government Institutions
* Critical Infrastructure
* Non-Profit Organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Perpetrator Types

A

Individual Hackers
* Organized Cybercriminal Groups
* Hacktivists
* State-Sponsored Actors
* Script Kiddies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What Means or Methods are used for cyber crime

A

Latest Trends
+ Phishing / Social Engineering
+ Malware
+ Exploiting Vulnerabilities
+ Insider Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Timeline/actions of cybercrime attack

A
  1. Reconnaissance:
  2. Initial Breach:
  3. Exploitation
  4. Execution:
  5. Covering Tracks:
  6. Detection and Response:
  7. Investigation:
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Malware analysis process

A

Extracting the malware
Static analysis
Blackboxing (Dynamic analysis)
Internet search (OSINT)
White boxing (reverse engineering)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Common signs of malware infection

A

Slow performance
Frequent freezing or crashing
Diminshed storage space
Unwanted pop-up advertisements
Modified or deleted files
New programs or icons
Changes in security settings
Unusual network activity
Browser changes
Unusual emails/social media messages
Programs running without consent
Error messages
Cmaera indicator light remains/turns on
Suspicious applications appear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Malware spreading techniques

A

Phising
malvertising: malware in ads
Drive-By downloads: automatically download when visiting compromised site
social engineering (more handso n than phishing)
Malicious links social media
Software bundling
RDP exploits
Lateral movement
Typosquatting
Torrents and P2P sharing
Infected removable media
Exploiting unpatched vulns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Payload types

A

Destructive
Non-Destructive
Criminal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What destructive payload types are there?

A

Designed to cause damage to system, data, or networks

Ransomware: Encrypts fiels and demans payment
Wiper malware: deletes data
Viruses: attaches to legit programs and corrupts/deletes files
Worms: self replicates and spreads across networks, causes disruptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Non destructive malware payload types

A

Compromises privacy or performance without directly damaging data
Spyware: Monitors users
Adware: displays unwanted ads, tracks behavior
Trojan horses: Disguises as legit software to trick users
Fileless malware: operators in memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Criminal malware payloads

A

Designed for financial gain or illegal activities:
Cryptojacking: hijacks resources to mine crypto
Botnets: network of infected devices used for coordinated attacks
Keyloggers
Backdoors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PE structure

A

Header: immediatly after DOS header, file header/optional header, metadata about the file architecture type, number of sections, characteristics

Section table: lists all section in executable (.text, .data, .rdata, . rsrc etc)
.text = executable code
.data initialized global vars
.rsrc contains resources icons and strings

Data directories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

PE structure and malware analysis

A

Malware can insert additonal code into unsed section of PE file (CODE CAVES)
Alter section headers to cause unexpected behaviour/bypass detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Static analysis, what aspects are analysed

A

Examines code and properties without execution
* Aspects analyzed:
+File Type
+File Hash
+Strings
+Embedded Elements
+Packer Information
+Imports and Exports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Static Analysis techniques used

A

Techniques Used
+ File Identification: Use ‘file’ or ‘sigcheck’
commands
+ Hashing: Calculate MD5, SHA1, SHA256 hashes
+ String Extraction: Use ‘strings’ command
+ Disassembly: Convert machine code to assembly
+ Code Analysis: Analyze for malicious patterns
+ Metadata Examination: Review file metadata
+ VirusTotal Submission: Scan against multiple AV
engines

17
Q

Static analysis tools

A

PE studio
CFF explorer: Examines PE file structure
YARA
STrings
Floss
Capa
SSDEEP

18
Q

Static analysis benefits and limitations

A

Benefits of Static Analysis
* Speed: Quick analysis without execution
* Safety: Avoids risks of running malware
* Comprehensive Insight: Examines entire code structure
* Detection of Known Threats: Identifies known malware families

Limitations of Static Analysis
* Inability to Detect Runtime Behavior: Misses dynamic threats
* Complexity with Obfuscation: Challenges with obfuscated code
* False Positives: May misidentify benign files as malicious

19
Q

Packers, are what?

A

Software tools that transform executable files
Aspects:
Compression/Encryption/Obfuscation
Type of packers:
Commercial (UPX, ASPack, Themida)
Custom packers
Crypters

Indicated by high entropy

20
Q

Tools to identify packers/packed data

A

PEiD
Detect it Easy (DIE)
Bintext
PE Explorer
CFF explorer

21
Q

Autorun options for malware

A

Registry
Startup folders
Services
Browser helper objects
Scheduled tasks

22
Q

Typical Windows 11 OS related Paths Relevant to Malware Analysis System Directories

A
  1. C:\Windows: Windows installation directory
  2. C:\Windows\System32: Primary system directory, often targeted for DLL hijacking
  3. C:\Windows\SysWOW64: 32-bit system directory on 64-bit systems
23
Q

Typical Windows 11 Paths Relevant to Malware Analysis User Directories

A

C:\Users[Username]\AppData\Roaming: User-specific application data, often used
by malware for persistence
5. C:\Users[Username]\AppData\Local: Local application data, less commonly
synced
6. C:\Users[Username]\AppData\LocalLow: Used for low-integrity level processes

24
Q

Startup system directories and reg run keys

A

Startup Locations
10. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp: Startup
folder for all users
11. C:\Users[Username]\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup: User-specific startup folder
Registry Run Keys
12. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run:
System-wide autorun programs
13. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run: User-
specific autorun programs

25
Q

Registry hives, which 4 are there?

A

Registry data is stored in files known as hives. Each hive corresponds to a specific set of
keys and values. The main hives include:
* SYSTEM: Contains system configuration settings.
* SOFTWARE: Stores software-related settings.
* SECURITY: Holds security policies.
* SAM: Contains user account information.
These hives are loaded into memory by the Configuration Manager, which manages
registry operations.
All hives are stored as files under Windows\System32\config

26
Q

Main Root Keys registry windows, which are there?

A

HKEY_LOCAL_MACHINE (HKLM): Contains configuration settings for the local
machine.
* HKEY_CURRENT_USER (HKCU): Stores settings specific to the currently logged-in
user.
* HKEY_USERS (HKU): Contains user profiles for all users on the machine.
* HKEY_CLASSES_ROOT (HKCR): Merges information from HKCU and HKLM
regarding file associations.
* HKEY_CURRENT_CONFIG (HKCC): Contains information about the current hardware
profile

27
Q

Common Malware Persistence Locations registry

A
  1. The Windows Run keys:
    HKLM\Software\Microsoft\CurrentVersion\Run
  2. The Winlogon shell:
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
  3. Services

Only 1-5, no need to remember details
1. Run Keys
– Description: Used to automatically start programs during system boot or
user login.
– Registry Paths:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\Run
2. RunServices Keys
– Description: Similar to Run Keys but specifically for Windows services.
– Registry Path:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session
Manager\RunServices
3. BootExecute
– Description: Executes specified programs early in the Windows boot process.
– Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\BootExecute
4. AppInit_DLLs
– Description: Allows specified DLLs to be loaded into every process that uses
User32.dll.
– Registry Path: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Windows\AppInit_DLLs
5. Active Setup
– Description: Configures Windows components before or during user logon.
– Registry Path: HKEY_LOCAL_MACHINE\Software\Microsoft\Active
Setup\Installed Components

28
Q

Service and Process Manipulation reg keys

A
  1. Windows Services
    – Description: Malware can create new services or modify existing ones to
    achieve persistence.
    – Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  2. Image File Execution Options (IFEO)
    – Description: Can be used to persist malware and intercept the execution of
    legitimate programs by specifying a debugger or alternative executable.
    – Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\Image File Execution Options
  3. Known DLLs
    – Description: Forces the loading of malicious DLLs by overriding system DLLs
    listed in the KnownDLLs registry key.
    – Registry Path:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
    Manager\KnownDLLs
29
Q

What are rootkits tldr?

A

Rootkits are programs that gain hidden control of a computer
system by modifying the operating system itself
* Their main purpose is to conceal malware activity from users and
security tools, preventing detection of the compromised state
* Despite the name, rootkits don’t provide root access - they
actually require admin/root privileges to be installed
* Initial system compromise and elevated privileges must be
achieved through other means before a rootkit can be deployed

30
Q

Basic Rootkit Goals

A

Gain system access
Maintain persistence
Hide presence
Control resources

31
Q

Rings of Control

A

Ring 3 (User Mode):
- Where normal applications run
- Limited privileges
- Restricted access to hardware
- Uses Windows API for system
requests
Ring 0 (Kernel Mode):
- Highest privilege level
- Direct hardware access
- Controls system resources
- Handles critical operationsa.
Application makes a request (e.g.,
CreateFile)
* Win32 API processes the request
* NTDLL.dll converts to system call
* Transition to kernel mode
* SSDT routes to correct kernel
function

32
Q

Common Rootkit Techniques, what techniques are commonly used by?

A
  • System Call Hooking:
    + Intercepts program requests
    + Modifies what system sees
    + Hides malicious activity
    Driver Level Attack:
    + Loads malicious drivers
    + Gets kernel access
    + Modifies core system
    Direct Kernel Manipulation:
    + Changes system tables
    + Modifies memory
    + Alters core function
33
Q

OSINT Basics

A

Open-source intelligence (OSINT) is the collection and analysis
of data from publicly available sources to produce actionable
intelligence.
+ Collection
+ Processing
+ Analysis
+ Reporting

34
Q

Tor feitjes

A

Directory updates
* Web Browsing -> Circuit A
* .onion sites -> Circuit B
* New HTTPS -> Circuit C

  • Guard rotation
    + Every 2-3 months
    + Helps prevent profiling
  • Usage-based rotation
    + After specific data amounts
    + After number of TCP streams
  • Time-based rotation
    + New circuits every ~10 minutes
    + Clean circuits every ~30-60 seconds

Oefenen virussen (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions