▸case-09 When analyzing API execution logs from a sandbox run, the malware executes `GlobalMemoryStatusEx` and evaluates whether `ullTotalPhys` is less than 2 GB (2,147,483,648 bytes). What evasion check category does this physical RAM query represent? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 A behavioral report lists a sequence of process API calls where `GetCursorPos` is called 50 times in a tight loop, and the process terminates immediately if the `POINT` coordinates remain identical across all calls. An analyst proposes labeling this as user privilege discovery. What is the proper evasion category and MITRE ATT&CK sub-technique for this mouse position check? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 A Cuckoo Sandbox behavioral JSON report shows a suspicious sample making repeated calls to `GetTickCount` immediately before and after a high-iteration empty `for` loop, followed by a conditional branch that terminates execution if the elapsed time is below a threshold. An analyst suggests classifying this behavior under generic process discovery (T1082). How should this API call pattern be categorized and mapped in terms of evasion techniques? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 You are writing a Python parser for Cuckoo Sandbox report JSON files (`report.json`). In which JSON path structure are the API calls and function names recorded within the process execution hierarchy? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 A security analyst needs a structured JSON output schema from an evasion analysis script parsing sandbox behavioral reports. What key fields should be included in the JSON output report to document the evasion findings? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 A sample analyzed in AnyRun calls `GetAsyncKeyState` in a loop checking for physical keypresses before decrypting its payload. An analyst suggests mapping this under Input Capture (T1056). What is the correct sandbox evasion category and sub-technique mapping for this check? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 A SOC engineer needs to analyze a `.pcap` capture file containing TCP session traffic between a compromised internal endpoint and an external IP address to extract HTTP POST C2 beacon payloads and user-agent strings. Outline the Wireshark filter commands for network payload extraction. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 In an automated malware report parser, you observe a process requesting a delay of 300,000 milliseconds via `Sleep`, but the sandbox's high-precision execution timestamp shows only 1,200 milliseconds elapsed before the next instruction executed. A junior analyst assumes the sandbox successfully executed the full 5-minute wait. How should this discrepancy between requested sleep time and actual sandbox runtime be flagged? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 An automated parser analyzes a report where an executable calls `GetSystemPowerStatus` to verify if AC power is plugged in or if a battery is present. How should this system configuration check be mapped in MITRE ATT&CK T1497 sub-techniques? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 In a malware analysis report, a binary executes WMI queries (`IWbemServices::ExecQuery`) querying `SELECT * FROM Win32_ComputerSystem` to inspect the `Model` field for 'VirtualBox' or 'VMware'. Which evasion mechanism category does this WMI query fall under? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 When scoring evasion sophistication for an analyzed sample, one sample exhibits 1 single check (a `Sleep` delay), while another sample exhibits 5 distinct checks across 4 different categories (sleep inflation, `vmtoolsd.exe` process check, `GetCursorPos` mouse check, and RAM size check). How should sophistication scoring evaluate these two samples? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 A malware analyst is examining an unparsed PE32 executable binary file using static analysis tools like `pefile` and `capa` to determine if it is packed with UPX or ASPack, without executing it in any automated analysis platform. Produce a step-by-step static analysis workflow for inspecting PE headers, section entropy, and import tables. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 An AnyRun report JSON export records a binary invoking `GetSystemInfo` and reading `dwNumberOfProcessors`, terminating if the returned integer is equal to 1. Should this check be categorized as software installation discovery (T1518) or as environment fingerprinting under sandbox evasion? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 A malware report contains API calls querying `GetDiskFreeSpaceExW` to verify if total disk capacity is under 40 GB. What evasion technique category should be assigned to this storage check? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 A sandbox JSON log records a malware sample executing `SetupDiGetClassDevsA` and enumerating device interface details to look for virtual disk bus drivers. Which evasion category does this hardware driver check belong to? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 A malware sample attempts sandbox evasion by invoking the `RDTSC` (Read Time-Stamp Counter) assembly instruction twice to measure CPU clock cycles elapsed during an operation. An analyst wants to know if this should be categorized as system information discovery or time-based evasion under T1497. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 A behavioral analysis report shows a malware process querying Network Adapter details and evaluating whether the MAC address prefix starts with `00:05:69`, `00:0C:29`, or `00:50:56`. What evasion category should this network interface check be labeled under? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 An analyst is reviewing process creation logs from a sandbox report and discovers a malware sample executing `Process32FirstW` / `Process32NextW` while comparing string names against `vmtoolsd.exe`, `vboxservice.exe`, and `vboxtray.exe`. How should this process enumeration act be classified in an evasion analysis schema? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 During analysis of an AnyRun report, a sample is found executing `GetLastInputInfo` to check how many seconds have elapsed since the user last provided mouse or keyboard input. What evasion category and MITRE ATT&CK sub-technique should be assigned to this idle time check? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 During an incident response engagement, an investigator acquires a Windows kernel memory dump file (`MEMORY.DMP`) from an infected host and wants to extract unbacked injected DLLs using Volatility 3 plugins like `windows.malfind` and `windows.pslist`. Provide a command guide and procedure for analyzing memory artifacts. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 When parsing API traces in a malware analysis log, the process calls `RegOpenKeyExW` targeting `HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0` and inspects the `Identifier` value for strings like `VBOX` or `VMware`. A defender asks whether this should be flagged as file system discovery or VM artifact detection. What is the precise evasion sub-category and MITRE ATT&CK sub-technique for this registry lookup? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 A malware sample calls `QueryPerformanceCounter` twice separated by a minor operation, then computes the frequency difference using `QueryPerformanceFrequency`. If the execution time difference is 0, it exits. Which evasion sub-technique under T1497 does this timing check map to? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |