A security team received an alert of suspicious activity on a user's Internet browser.
The user's anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address.
Which two actions should be taken by the security analyst with the executable file for further analysis? (Choose two.)
Click on the arrows to vote for the correct answer
A. B. C. D. E.BC.
In this scenario, a security team received an alert of suspicious activity on a user's Internet browser, where the anti-virus software indicated that the file attempted to create a fake recycle bin folder and connect to an external IP address. To perform further analysis on the executable file, the security analyst should take the following two actions:
Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid): By analyzing the TCP/IP streams in Cisco Secure Malware Analytics (Threat Grid), the security analyst can determine the communication protocols and ports used by the file. It can help identify the external IP address that the file attempted to connect and the type of data exchanged during the communication. Analyzing the TCP/IP streams can also provide insights into any potential malicious network activity, including command and control communication.
Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid): Evaluating the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid) can help the security analyst to identify any suspicious or malicious behavior performed by the file. For instance, the file attempting to create a fake recycle bin folder could be an indication of a malicious file trying to hide its presence. By evaluating the behavioral indicators, the security analyst can identify any other potential malicious activity, such as attempts to modify system settings or registry keys, install additional files or services, and so on.
Hence, option B (Analyze the TCP/IP Streams in Cisco Secure Malware Analytics (Threat Grid)) and option C (Evaluate the behavioral indicators in Cisco Secure Malware Analytics (Threat Grid)) are the correct actions to be taken by the security analyst with the executable file for further analysis.