A city SOC reviews a malicious Word macro on a permitting workstation that writes a second-stage binary to disk before launching it. Which malware role best matches that behavior?
Select an answer to reveal the explanation.
Short Explanation
Picture a sneak who slips a bag of tools onto the desk, then walks away—that bag-drop is the dropper. The Word macro’s job was to land the next binary, not to be the final thief. City SOC triage names the stage so playbooks fire correctly.
Full Explanation
In municipal malware triage, a dropper is software whose primary purpose is to deliver, write, and start another malicious component rather than to complete the final business impact itself. On a city permitting workstation, a malicious Word macro that writes a second-stage binary to disk and then launches it matches that role: the macro is the delivery vehicle for a follow-on payload, not the encryptor, beacon, or scanner. City SOC analysts should label the observed stage from evidence—file write plus execute after macro run—so containment, hunting, and playbook selection align with an initial delivery/install stage instead of assuming the end-state crime is already complete.
The ransomware-encryptor option fails because hostage encryption is a payload objective that may arrive later; writing and launching a second-stage binary does not prove encryption or ransom demand has already occurred on the permitting host. A C2 beacon whose only job is periodic check-ins without a file drop fails because the stem explicitly describes writing a binary to disk and starting it, which is staging behavior beyond mere beaconing. A vulnerability-scanner plugin used in authorized assessments fails conceptually: assessment tooling is not malware role taxonomy for a malicious macro, and the behavior described is unauthorized second-stage delivery, not scoped scanning.
Exam caveat: GOAA Domain 6 malware fundamentals test role/stage naming from observable behavior. Do not equate every municipal malware event with ransomware, and do not invent capabilities the stem never stated. Dropper, downloader, and payload are related but not synonyms; choose the label that best fits the described action.
Operational check for a city SOC: confirm the written binary path, hash, and parent process (Word/macro host), isolate the permitting workstation, block outbound retrieval if still active, and hunt peer workstations for the same second-stage hash or launch pattern before assuming the incident is only a phishing curiosity.