312-39V2: Certified SOC Analyst v2

The SOC team at a national cybersecurity agency has identified anomalous network traffic originating from a sensitive government server. Initial analysis indicates a possible intrusion, so the SOC team escalates the incident to the forensic team for a deeper investigation.

During forensic examination, the team finds a trojan on the compromised server. The trojan is suspected of performing data exfiltration, creating concerns about possible backdoor access and long-term persistence mechanisms used by the malware.

Given the seriousness of the situation, the lead malware analyst is assigned to perform an in-depth analysis of the trojan to identify its capabilities (e.g., command execution, privilege escalation, keylogging), its persistence mechanisms (e.g., registry modifications, scheduled tasks, startup entries), and any backdoor functions (e.g., remote access, hidden communication channels). However, because of the system’s sensitive nature and the risk of unintended execution, the analyst must examine the trojan’s binary code at the instruction level without executing it. Which technique should the forensic analyst use?