A hospital sandbox report offers three usable lines: a file hash, a contacted URL, and a service the sample created. Which line is the host persistence artifact?
Select an answer to reveal the explanation.
Short Explanation
A spare key under the mat is what lets someone return, while the key serial only identifies the key. You pick the created service as the host persistence artifact. The trap is the file hash, the contacted URL, or the sandbox product version.
Full Explanation
Persistence is a host change that can start the sample again later. A service created by the sample is that kind of change. A hash identifies the file, a URL shows a network call, and a product version identifies the sandbox build. "The created service, a host change that can start the sample again after reboot" is the persistence artifact. "The file hash, a fingerprint that identifies the sample and not a lasting host change" does not alter how the host starts software. "The contacted URL, evidence of a network call rather than a host change that remains" is a destination, not a startup mechanism. "The sandbox product version printed in the report header for this detonation run" describes the analysis tool, not the sample's change to the host. Exam caveat: the hash still matters for identifying the file, and it is not the line that shows persistence. Operational check: compare the service name in the report with services on the hospital host and confirm the sample created it. That service line is the persistence artifact to track on the host.