PowerShell in Malware Analysis

What is PowerShell primarily designed for?

• Web development

• System administration and automation

• Creating video games

• Designing graphical user interfaces

Why is PowerShell a common tool leveraged by attackers?

• It is not detectable by antivirus software.

• It has limited access to system functionalities.

• It provides powerful access to Windows internals.

• It is only available on older versions of Windows.

What is a cmdlet in the context of PowerShell scripts?

• A large script used for deploying applications

• A lightweight command that is used in scripting

• A variable used to store sensitive information

• A tool for debugging scripts

Which of the following is a common obfuscation technique used in PowerShell scripts by attackers?

• Using simple and clear variable names

• Avoiding the use of cmdlets

• Writing the entire script on a single line

• Encoding commands in Base64

The PowerShell ISE allows for what kind of script interaction?

• Only executing scripts without viewing their content

• Editing scripts but not running them

• Line-by-line execution to observe script behavior

• Translating scripts into other programming languages

Which of the following best practices is recommended for formatting PowerShell scripts?

• Use semicolons to separate all statements

• Place open curly braces { at the beginning of a new line

• Use line breaks and indentation to structure your code logically

• Write the entire script in uppercase for readability

What does the cmdlet Invoke-Expression (IEX) do in a PowerShell script?

• Converts a script into an executable file

• Invokes a web request to a specified URL

• Executes the string it receives as a PowerShell command

• Encrypts the script for secure transmission

In the lab, what is the purpose of setting starting FakeNet-NG?

• To ensure the fastest Internet connection speed

• To simulate the Internet environment for the script

• To disable all network connections

• To create a backup of the network settings

What is the final goal of the PowerShell script analyzed in the lab?

• To update Windows to the latest version

• To download malware from a specified URL

• To encrypt all files on the system

• To send an email to the system administrator

What tool is used in the lab to capture and analyze network traffic when executing the PowerShell script?

• Wireshark

• Nmap

• Metasploit

• Burp Suite