Details of what happens when the file is opened in a controlled sandbox:
Does it attempt to connect to a Command and Control (C2) server? Look for suspicious IP addresses or DNS requests. Victoria Bravo.rar
Does it launch a secondary process? (e.g., cmd.exe , powershell.exe ). Details of what happens when the file is
List the files inside the RAR. Look for common malicious extensions like .exe , .vbs , .js , or double extensions like .pdf.exe . 3. Dynamic (Behavioral) Analysis Victoria Bravo.rar
This section covers information about the file without actually executing it:
Note if it creates "persistence" by adding itself to the Windows Registry startup keys or moving files to C:\Users\...\AppData . 4. Indicators of Compromise (IOCs)