Question

A SOC analyst receives a suspicious executable and must prepare it for transfer to the malware analysis team and for documentation in the case ticket. Before storing and sharing the live sample among analysts, which handling practice should the analyst apply first to prevent accidental execution while preserving the file for analysis?

Accepted Answer

Compress the sample into a password-protected archive and record its cryptographic hash before distribution

Answer

Execute the sample once in the production sandbox to confirm it is malicious before archiving it

Answer

Rename the file with a .txt extension and email it directly to the analysis team

Answer

Delete all metadata from the file and upload it unaltered to a shared network folder