A detonation sandbox returns a report for an emailed invoice.docm. The behaviour summary lists: spawns powershell.exe with an encoded command, writes %APPDATA%\svc\upd.exe, creates a Run key for that path, and queries api.ipify.org. VirusTotal shows the file hash at 2 of 72 engines. An analyst must decide how to weight this before responding. Which conclusion is best supported?
processes: winword.exe -> powershell.exe -enc <base64>
filesystem: write %APPDATA%\svc\upd.exe
registry: HKCU\...\Run\svc = %APPDATA%\svc\upd.exe- AThe low 2/72 detection ratio outweighs the behaviour, so the file should be treated as likely benign pending more engine coverage.
- BThe query to api.ipify.org confirms active data exfiltration to an attacker server, which is the single finding that determines the verdict.
- CThe observed macro-spawned encoded PowerShell, dropped executable and Run-key persistence are strong behavioural indicators of malware regardless of the low hash reputation, and the sample should be treated as malicious. Correct
- DBecause only 2 engines flagged the hash, the sandbox result is probably a detonation artefact and the document should be released to the user.
Why A is wrong: Tempting because a low hit count feels reassuring, but reputation lags for fresh or targeted samples and cannot override concrete malicious behaviour already observed in the sandbox.
Why B is wrong: Tempting because an external callout looks like exfiltration, but ipify only returns the host's public IP and is used benignly too, so it is weak evidence compared with the persistence and drop behaviour.
Why C is correct: Correct: dynamic behaviour showing execution, payload drop and persistence is direct evidence of malicious intent, and a low VirusTotal ratio is expected for novel samples and does not diminish it.
Why D is wrong: Tempting because sandboxes can produce noise, but macro-to-encoded-PowerShell with Run-key persistence is not incidental instrumentation, and releasing the file would deliver working malware.