A hotel sandbox report shows a dropped file and the hash of that drop, and a guest laptop still has a file with the same hash. What does that match establish?
Select an answer to reveal the explanation.
Short Explanation
A matching fingerprint on a glass means that glass was at the scene, not that you know the owner's name. The hash of the sandbox file drop matches a file still on the guest laptop, so that dropped file is on the laptop. The trap is calling the laptop the sandbox, treating the hash as the actor name, or reading the URL list as the file body.
Full Explanation
The sandbox recorded a file drop and the hash of that drop. The guest laptop still has a file with the same hash. A hash identifies content, so the dropped file from the report is present on the laptop. The match establishes "The dropped file is on the laptop, identified by the hash that matches the sandbox drop". The sandbox is the detonation environment, not the guest machine under the report, so "The guest laptop is the sandbox environment, so the detonation itself ran on that guest machine" fails. A hash does not name a person. It cannot prove who placed the file, so "The hash proves the actor's name and ties the dropped file to a known person" fails. The URL list shows where the sample called. It is not the bytes of the dropped file, so "The URL list in the report is the body of the file stored on the guest laptop" fails. Exam caveat: a hash match shows the same content, not who copied the file onto the laptop or why it is there. Operational check: hash the laptop file and compare that digest with the drop hash in the report before treating the laptop file as the dropped artifact.