CFR-410 practice question 1 of 25

A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the ~COMPANYWIDE mailing list and, shortly…

Full set: 180 questions
A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the ~COMPANYWIDE mailing list and, shortly thereafter, users across the company receive the following message: “You seem tense. Take a deep breath and relax!” The incident response team is activated and opens the picture in a virtual machine to test it. After a short analysis, the following code is found in C: \Temp\chill.exe:Powershell.exe –Command “do {(for /L %i in (2,1,254) do shutdown /r /m Error! Hyperlink reference not valid.> /f /t / 0 (/c “You seem tense. Take a deep breath and relax!”);Start- Sleep –s 900) } while(1)” Which of the following BEST represents what the attacker was trying to accomplish?
Answer options
A: Taunt the user and then trigger a shutdown every 15 minutes.
B: Taunt the user and then trigger a reboot every 15 minutes. Correct answer
C: Taunt the user and then trigger a shutdown every 900 minutes.
D: Taunt the user and then trigger a reboot every 900 minutes.
Correct Answer:
B. Taunt the user and then trigger a reboot every 15 minutes.
Explanation

The provided code executes a PowerShell command within an infinite loop (do...while(1)). The core of this loop is the shutdown command and a Start-Sleep cmdlet. The shutdown /r switch specifically instructs the operating system to reboot, not shut down. The /c switch displays the taunting message. The Start-Sleep –s 900 command pauses the script's execution for 900 seconds. Converting seconds to minutes (900 / 60) equals 15 minutes. Therefore, the script's intent is to display the message and initiate a system reboot every 15 minutes.

Why Incorrect

A. The shutdown command uses the /r switch, which explicitly means to reboot the computer, not shut it down.
C. This is incorrect on two points: the command is for a reboot (/r), and the interval is 15 minutes (900 seconds), not 900 minutes.
D. The time interval specified by Start-Sleep –s 900 is 900 seconds, which translates to 15 minutes, not 900 minutes.

References

1. Microsoft Corporation. (n.d.). Shutdown Command-Line Options. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown. (This document confirms that the /r parameter is used to "Restart the computer.")

2. Microsoft Corporation. (2023, July 27). Start-Sleep. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/start-sleep. (This official documentation specifies that the -s or -Seconds parameter "Specifies how long the resource sleeps in seconds.")

3. Purdue University. (n.d.). Malware and Malicious Code. Courseware for CS 42600 (Computer Security). Retrieved from https://www.cs.purdue.edu/homes/ninghui/courses/426Fall15/lectures/21-malware.pdf. (Page 4 discusses how malware, such as logic bombs, can execute payloads that include system commands like shutdown to disrupt operations, which is consistent with the scenario.)

Scroll to Top