Browser LabLD-MAL-LAB-002Medium
Browser LabLD-MAL-LAB-002Medium26 min
The Sample That Wasn't Malware
An EDR alert flagged bkupagent.exe on a Badr server as 'suspicious'. The SOC wants a malware verdict. You have the sandbox behavior report, the file's signature status and the change records. Your job is the honest verdict — a suspicious-looking sample is not the same as a malicious one, and calling benign software malware has its own cost.
What you will be able to do
- Read behavior in the context of legitimacy signals (signature, change records).
- Distinguish 'unusual' from 'malicious'.
- Reach a defensible verdict, including 'benign'.
IOC AnalysisWindows SecurityAnalyst Reporting
Sign in to start this lab.
Sign in