Read the Sandbox Report

A sandbox is an isolated environment where a sample is observed while it runs, and it produces a report of what happened: files touched, registry-style settings changed, processes started and network connections attempted. Reading such a report quickly is a core analyst skill, and this lab gives you one to read.

The report belongs to a fictional, inert specimen and was generated for this exercise. It describes how the sample keeps itself running after a restart (its persistence) and how often it contacts its server (its beacon interval). Answer the questions in each step from the report itself, not from guesswork about what such samples usually do.

A good approach is to skim the section headings first, then read the events in time order, and finally return to the details that matter. Note that a report only shows what was observed on one run; an absence is not proof of absence. Every host in the report is fictional and uses the reserved example suffix.