Source: Juni_2026_Exams/Advance_Forensics/notes/14-exam-day-open-notes-reference.md

Exam-Day Open-Notes Reference

Use This First

For every question:

1. Identify what is being asked.
2. Select the tool and evidence source.
3. Preserve the original output before adding filters.
4. Record exact paths, APIs, PID/TID values, and raw results.
5. Take a readable screenshot.
6. Answer directly, then explain why the evidence supports it.

Do not copy example PID/TID values into your answer. Use values from your run.

Safe Lab Setup

• Use only the university malware-analysis VM.
• Restore a clean snapshot before each new sample.
• Disable shared clipboard, drag-and-drop, shared folders, USB, and host mounts.
• Use internal/host-only networking and FakeNet unless instructed otherwise.
• Never execute a sample on the host.
• Save screenshots and reports before restoring the snapshot.

Fast Tool Selection

Initial Sample Record

Sample:
Full path:
File size:
SHA-256:
VM snapshot:
Execution privilege:
Analysis start time:
Network mode:

PowerShell:

Get-FileHash C:\Temp\sample.exe -Algorithm SHA256
Get-Item C:\Temp\sample.exe | Select Name,Length,CreationTime,LastWriteTime

Search VirusTotal by hash before uploading. Do not upload confidential samples unless explicitly permitted.

Static PE Triage

CFF Explorer

Inspect:

DOS Header
  e_magic       -> MZ signature
  e_lfanew      -> offset to PE header

NT Headers / File Header
  Machine       -> x86/x64 architecture
  NumberOfSections
  TimeDateStamp -> can be forged
  Characteristics -> EXE/DLL/32-bit flags

Optional Header
  Magic         -> 010B PE32, 020B PE32+
  AddressOfEntryPoint
  ImageBase
  SectionAlignment
  FileAlignment
  SizeOfImage
  Subsystem

Section Headers
  Name
  VirtualSize
  SizeOfRawData
  Characteristics/permissions

Import Directory
Export Directory
Resource Directory

Useful calculations:

VA = actual ImageBase + RVA
RVA = VA - actual ImageBase

Magic bytes:

MZ: 4D 5A
PE signature: 50 45 00 00

Packing Decision

Do not rely on one indicator.

Good conclusion:

The file is likely packed. DiE reports entropy of [value], the section
layout shows [indicator], and [PEiD/DiE] identifies [packer/signature].
High entropy alone would not prove maliciousness, but these indicators
together support packing.

Strings and Imports

Look for:

• paths and filenames
• URLs, domains, IP addresses, user agents
• commands and command-line arguments
• registry paths
• service/task names
• mutex names
• debug/evasion messages
• DLL and API names

Important API categories:

Static imports suggest capability, not confirmed runtime behavior.

ProcMon Quick Guide

Clean Capture

Ctrl+E -> stop/start capture
Ctrl+X -> clear existing events
Ctrl+L -> filters
Tools -> Process Tree
Options -> Select Columns

Recommended columns:

• Time of Day
• Process Name
• PID
• TID
• Operation
• Path
• Result
• Detail
• Command Line
• Parent PID

Basic workflow:

1. Stop capture.
2. Clear events.
3. Add Process Name is sample.exe → Include.
4. Start capture.
5. Execute the sample.
6. Stop capture.
7. Save the complete PML trace.
8. Apply question-specific filters.

Useful Operations

Useful filters:

Process Name is sample.exe                 Include
Path begins with C:\Temp                   Include
Operation is CreateFile                    Include
Operation is WriteFile                     Include
Operation contains Thread                  Include
Category is Write                          Include
Result is ACCESS DENIED                    Include

CreateFile can open an existing file. Check Detail, following WriteFile events, and whether the path existed before execution.

APIMiner and API Monitor

The 2025 VM answer used:

C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe

Preserve every generated trace. Search API names and inspect nearby calls and arguments. Do not prove injection from a single API.

Process-Injection Cheat Sheet

Four Exam Stages

Privilege-related APIs:

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

Classic DLL Injection

CreateToolhelp32Snapshot / Process32First / Process32Next
-> OpenProcess
-> VirtualAllocEx
-> WriteProcessMemory (DLL path)
-> GetModuleHandle / GetProcAddress (LoadLibrary)
-> CreateRemoteThread

Shellcode Injection

OpenProcess
-> VirtualAllocEx
-> WriteProcessMemory (raw shellcode)
-> VirtualProtectEx if needed
-> CreateRemoteThread

Section Mapping / Hollowing Indicators

CreateProcess with CREATE_SUSPENDED
NtCreateSection
NtMapViewOfSection
NtUnmapViewOfSection
GetThreadContext
SetThreadContext
ResumeThread

Strong Explanation

The trace supports process injection because the sample first [found/opened]
the target using [APIs], then prepared target memory using [APIs], placed or
mapped the payload using [APIs], and finally initiated execution using [APIs].
The sequence and cross-process parameters are stronger evidence than any
single API call.

Process Hacker Quick Guide

Inspect:

• process name, PID, parent PID, integrity level
• executable path and command line
• Threads tab: TID, start address, state
• Modules tab: DLLs loaded into the process
• Memory tab: base address, size, permissions, mapped image/private memory
• strings in process memory

For injection:

• unexpected DLL in target Modules tab
• private executable memory (RWX or changed RW to RX)
• thread start address in private/unbacked memory
• suspended/resumed target process
• memory containing injected strings/payload

PID and TID values change on every run.

Persistence Paths and Commands

Startup Folders

User:
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

All users:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Shortcuts:
shell:startup
shell:common startup

Run/RunOnce Keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run

Commands:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
wmic useraccount get name,SID

Services

Registry:
HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>

Important values:
ImagePath
Start
ServiceDll
ObjectName

Event logs:
System Event ID 7045
Security Event ID 4697

Commands:

sc query
sc qc <ServiceName>
reg query HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>

Scheduled Tasks

Files:
C:\Windows\System32\Tasks

Registry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

Commands:

schtasks /query /fo list /v

Other Persistence

BootExecute:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
Normal value commonly includes: autocheck autochk *

AppInit:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs

SilentProcessExit / IFEO:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Persistence conclusion:

Persistence is supported by [artifact] at [exact path]. The value/task/service
[name] launches [executable and arguments] when [trigger]. Autoruns/ProcMon
confirmed [corroboration]. The referenced file [exists/does not exist] at
[path].

Network Analysis

FakeNet Workflow

1. Restore snapshot.
2. Start FakeNet before the sample.
3. Start Wireshark on the isolated adapter.
4. Execute the sample.
5. Record DNS requests, HTTP requests, destination ports, timing, and payloads.
6. Stop capture and save the PCAP.

Useful Indicators

Wireshark display filters:

dns
dns.flags.rcode == 3
http
tls
tcp.stream eq <number>
ip.addr == <address>

For TLS decryption:

Wireshark -> Edit -> Preferences -> Protocols -> TLS
Set (Pre)-Master-Secret log filename to the provided SSL key log.

Registry Hive Loading - Supplemental

If an offline-registry question appears:

1. Export the hive with .LOG1 and .LOG2.
2. Load the working copy in Registry Explorer.
3. Record whether transaction logs were replayed.
4. For SYSTEM, read Select\Current.
5. If Current = 1, use ControlSet001; if 2, use ControlSet002.
6. Report both logical and offline paths.

Common hives:

C:\Windows\System32\config\SOFTWARE
C:\Windows\System32\config\SYSTEM
C:\Windows\System32\config\SAM
C:\Users\<user>\NTUSER.DAT
C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat

Verified 2025 Example Answers

These are examples from the uploaded answer PDF. Verify all results in your own exam run.

Example 1: Type and Packing

The sample is a 32-bit Windows Portable Executable. CFF Explorer identifies
the PE32 structure. DiE reports entropy of 7.99488, close to the maximum of 8,
and [additional section/signature evidence]. These indicators support that the
file is packed.

Evidence: Figure 1 (CFF Explorer) and Figure 2 (DiE Entropy).

Example 2: Created Files

The 2025 answer reported:

C:\Temp\old_sample.exe
C:\Temp\ui\
C:\Temp\ui\SwDRM.dll
C:\Temp\ui\IPHLPAPI.DLL
C:\Temp\ui\WINNSI.DLL
C:\Temp\ui\powrprof.dll
C:\Temp\ui\config.json

Answer form:

ProcMon shows that sample.exe created [items] under C:\Temp. The artifacts
were short-lived and were later deleted, as shown by [delete operation].
Figure [X] shows the process-name and C:\Temp path filters with the relevant
operations.

Example 3: Injection

The API trace supports process injection:

1. Target discovery/opening: [APIs and target].
2. Memory/privilege preparation: [APIs and parameters].
3. Payload mapping/writing: [APIs and target addresses].
4. Thread execution/manipulation: [APIs and TID/target].

The ordered cross-process sequence confirms the behavior more strongly than
any individual API.

The verified 2025 answer used:

Stage 1: CreateToolhelp32Snapshot, OpenProcess
Stage 2: LookupPrivilegeValueW, AdjustTokenPrivileges,
         VirtualAlloc, VirtualProtect
Stage 3: NtCreateSection, NtMapViewOfSection, NtUnmapViewOfSection
Stage 4: CreateThread, GetThreadContext, SetThreadContext

Example 4: Thread IDs

ProcMon, filtered with Operation contains Thread, shows [count] distinct
threads with IDs [your TIDs]. Figure [X] displays the filtered events and TID
column.

The old answer reported 3608, 3424, 1176, and 2684; do not reuse them.

Universal Answer Template

Question [number]: [short title]

Direct answer:
[One or two sentences answering exactly what was asked.]

Tool and method:
[Tool/version, command, filters, or navigation.]

Evidence:
- Source/path/API:
- Raw result:
- PID/TID/address where relevant:
- Screenshot: Figure [number]

Interpretation:
[Explain why the evidence supports the answer.]

Corroboration:
[Second tool/artifact, if available.]

Limitation:
[What this evidence does not prove or any uncertainty.]

Screenshot Checklist

Every screenshot should show:

• tool name/window
• sample/process name
• command or filter where possible
• relevant path/API/operation
• PID/TID/address if relevant
• enough context to understand the result

Use captions:

Figure 1. DiE identifies sample.exe as PE32 and reports entropy of [value].
Figure 2. ProcMon shows sample.exe creating [file] under C:\Temp.
Figure 3. APIMiner records [API] against target PID [PID].

Do not submit:

• unreadable full-screen screenshots
• screenshots without captions
• conclusions without visible evidence
• copied example values that do not match your run

Final Ten-Minute Review

• [ ] Every question has a direct answer.
• [ ] Tool, command, and filters are stated.
• [ ] Screenshots are readable and captioned.
• [ ] Paths, APIs, PID/TID, and values match screenshots.
• [ ] Packing uses multiple indicators.
• [ ] Injection is explained as a sequence.
• [ ] Example IDs were not reused.
• [ ] Observations and interpretations are separated.
• [ ] Required filename is correct.
• [ ] Final PDF opens and all pages/screenshots render.