6 process(es) observed

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it successfully executed within the sandbox environment. The following observations were made during the execution: 1. **Initial Access**: The sample did not exhibit any clear initial access methods, as no specific exploit or delivery mechanism was observed in the static or dynamic analysis. 2. **Execution**: The sample executed successfully, spawning six processes, including `cmd.exe`, which suggests command execution capabilities. 3. **Persistence**: There were no indications of persistence mechanisms being established by the sample. No registry keys or other methods typically used for persistence were observed. 4. **Defense Evasion**: The sample did not demonstrate any specific techniques for evading detection or analysis during its execution. 5. **Command and Control (C2)**: The sample performed a DNS query for the domain `example.com`, indicating potential communication with a remote server. However, no further network activity or C2 communications were observed. 6. **Impact**: There were no observable impacts on the system, such as file modifications or malicious activities beyond the DNS query. In summary, while the sample executed and made a DNS query, it did not demonstrate significant malicious behavior or capabilities. The lack of persistence and defense evasion techniques suggests limited impact. The verdict is inconclusive due to the absence of clear malicious indicators beyond the DNS query. The presence of the domain `example.com` as an IOC may warrant further investigation, but it alone does not confirm malicious intent.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2369)
id: sandbox-auto-2369-reg
status: experimental
description: Auto-generated from sandbox scan 2369
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

rule auto_file_2369_yara
{
    meta:
        description = "Auto-generated from scan 2369"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "ipconfig /all" ascii fullword
        $s1 = "echo done > \"%TEMP%\\netcheck.log\"" ascii fullword
        $s2 = "type \"%TEMP%\\netcheck.log\"" ascii fullword
        $s3 = "nslookup example.com" ascii fullword
        $s4 = "rem Reports the local network configuration and reachable name servers." ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).