Unit 4: Malware Persistence, Injection and Hooking - Practice Quiz

1 What is a common purpose of malware?

2 Which malware functionality allows an attacker to control an infected computer from another location?

3 What does keylogging malware primarily record?

4 What is malware persistence?

5 Which Windows feature is commonly abused to launch malware automatically at user sign-in?

6 How can a scheduled task provide persistence for malware?

7 Which persistence method involves configuring a program to run as a background Windows component?

8 What is virtual memory?

9 What is a page in a virtual memory system?

10 What does the operating system use a page table for?

11 In which processor mode do ordinary applications normally run?

12 Which mode has the highest level of access to system memory and hardware?

13 What mechanism allows a user-mode program to request an operating-system service?

14 What is code injection?

15 Which code injection technique loads a dynamic-link library into another process?

16 What is process hollowing?

17 Why might malware inject code into a trusted process?

18 What is hooking in malware analysis?

19 What can an API hook allow malware to do?

20 Which hooking technique modifies the beginning of a function so execution jumps to different code?

21 A malware sample records keystrokes only when a web browser is displaying a login page. Which functionality is the malware primarily implementing?

22 A sample encrypts documents, deletes available shadow copies, and displays a payment demand. What is its primary malware functionality?

23 An infected host periodically contacts a remote server, receives commands, and sends back execution results. Which functionality best describes this behavior?

24 A suspicious executable is launched whenever a particular user signs in. Analysis shows that its path is stored under the user's Windows Run registry key. What type of persistence is being used?

25 Malware must execute every day at 09:00 even when no interactive user session is active. Which persistence mechanism most directly supports this requirement?

26 A malicious executable is registered to start automatically as a Windows service during system startup. Why is this useful for persistence?

27 A legitimate application loads a malicious DLL from its working directory because that directory is searched before the intended library location. Which technique is involved?

28 During analysis, a process allocates a writable memory region, copies code into it, and then changes the region to executable. Why is the permission change significant?

29 The same DLL is loaded at different virtual addresses across two executions of a program. Which operating-system protection most likely caused this variation?

30 Two processes initially share a read-only mapped page. One process modifies the page and receives its own private copy. Which memory mechanism explains this behavior?

31 A memory scanner finds a private region that is executable but has no corresponding executable file mapping. Why might an analyst consider it suspicious?

32 A user-mode malware process attempts to access a hardware device directly but is blocked by the operating system. What is the main reason?

33 How does a user-mode application normally request a privileged operation such as reading data from a disk?

34 Why is a malicious kernel-mode driver generally more dangerous than ordinary user-mode malware?

35 A process allocates memory inside another process, writes a payload there, and starts a thread at the payload's address. Which injection technique is most consistent with this sequence?

36 Malware starts a legitimate executable in a suspended state, replaces its original image with malicious code, and then resumes it. Which technique is being used?

37 A payload is queued as an asynchronous procedure call for an existing thread and executes when that thread enters an alertable state. Which technique does this describe?

38 A DLL is loaded directly from a memory buffer without being registered through the operating system's normal module-loading path. Which technique best matches this behavior?

39 Malware modifies a program's Import Address Table so that calls to a file-opening API are redirected to malicious code. Which hooking technique is being used?

40 An analyst discovers that the first instructions of an API function were replaced with a jump to an unknown memory region. Which technique most likely caused this modification?

41 A sample periodically captures browser form data but transmits only compact probabilistic summaries rather than raw fields. Which capability is most strongly indicated by this behavior?

42 Malware resolves domain names generated from the current date, contacts several failed candidates, and accepts commands from the first domain that returns a correctly signed response. What is the primary purpose of combining these behaviors?

43 An investigator finds a permanent WMI event filter and a command-line event consumer, but the payload never executes when the filter condition becomes true. Which missing artifact most directly explains the failure?

44 A Windows service has Start=2, runs as LocalSystem, and references a payload on an encrypted user-mounted volume. The service consistently fails during early boot but starts manually after logon. Which change most directly preserves service-based persistence?

45 A scheduled task is configured with a logon trigger, but its action points to %TEMP%\stage.exe and runs as SYSTEM. Why may the task fail even though the executable exists in the logged-on user's temporary directory?

46 A process modifies a page from a PAGE_EXECUTE_WRITECOPY image section. VirtualQuery still reports the region as MEM_IMAGE. Which observation best determines whether that specific page became private?

47 A manually mapped DLL appears in executable MEM_PRIVATE pages but not in the process loader lists. Which combination most strongly distinguishes it from a normally loaded DLL?

48 A position-dependent PE image is mapped away from its preferred base, but its relocation directory was stripped. Under which condition can it still execute reliably without reconstructing relocations?

49 On x64 Windows, what fundamentally enforces the privilege transition when a user-mode ntdll system-call stub executes syscall?

50 A kernel rootkit unlinks a process from the operating system's normal active-process list without terminating it. Which detection strategy is most likely to reveal this direct kernel object manipulation?

51 Malware queues a user-mode APC containing a payload address to an existing target thread, but the payload never runs. Assuming the address and thread handle are valid, what is the most likely missing condition?

52 Which ordering correctly describes a conventional process-hollowing workflow?

53 A reflective DLL loader has copied all PE sections into a new allocation and resolved imports. The image works only when loaded at its preferred base. Which omitted step most directly explains this behavior?

54 An injector creates a section, maps one view locally and another into a target process, writes the payload through the local view, and starts execution at the remote view. What is the main injection-specific advantage of this design?

55 During transacted process injection, a payload image is written into a transacted file and an image section is created from it before the transaction is rolled back. Why can the mapped process image remain usable?

56 An analyst patches a process's import address table entry for CreateFileW, but some file opens remain unobserved. Which behavior most directly bypasses this hook?

57 When installing an x64 inline hook, why is copying a fixed number of initial bytes into a trampoline unsafe even when the jump patch fits?

58 A module's export address table is modified so that one exported function resolves to a hook. Which calls are least likely to be affected?

59 Why is direct modification of the System Service Descriptor Table generally unstable as a persistent hooking method on modern x64 Windows?

60 A hook uses PAGE_GUARD to intercept execution without changing a function's first bytes. After the first interception, later calls are missed. What must the handler typically do to sustain the hook?