You have an unknown Windows executable and two hours. What do you do, and what would you be able to tell the incident team at the end?

Static first, in an isolated environment, because it is fast and costs nothing.

Confirm what the file actually is rather than trusting the extension. Take SHA-256 for identity and a fuzzy hash such as ssdeep or TLSH for similarity clustering, which matters more for intelligence than exact matching. Look at PE structure — sections, entropy for packing indicators, and the import table, because the API surface tells you the capability. A very small import table usually means dynamic resolution, which is itself a finding. Pull strings, both ASCII and wide, looking for URLs, domains, IPs, registry paths, mutex names, user agents and build paths. Check whether it is signed and whether that certificate is valid, revoked or stolen.

Then run signature tooling: YARA rules for family identification, and CAPA for capability, which has the advantage of outputting ATT&CK technique mappings I can hand straight to detection engineering.

If static does not resolve it, detonate in an instrumented isolated VM. I want the process tree, any injection into other processes, the persistence mechanism — run keys, scheduled tasks, services, WMI subscriptions — what it drops and where, and the network behaviour including DNS, connection attempts, beacon interval and jitter, and URI patterns.

The single highest-value output is configuration extraction. Many families hold C2 addresses, a campaign identifier and keys in a decodable block, and public extractors exist for common families. That one artefact drives both the containment work and the infrastructure pivoting.

I would carry the caveats explicitly. The sample may check for a VM, a debugger, specific arguments, or the target's domain and locale, and do nothing if they are absent. If the C2 is already dead it will look inert, and absence of network activity is not absence of capability. And it may be a loader — the interesting behaviour could be in a stage I never received.

At the end I would not hand the incident team a list of artefacts. I would answer their questions: what family and at what confidence, what it can do mapped to ATT&CK, what infrastructure it talks to, whether this looks targeted or commodity, and therefore what to hunt for across the estate. Plus what I could not determine and whether it warrants escalating to reverse engineering — which I would recommend if the family is unknown and the configuration will not yield, or if a legal or attribution-critical judgement is going to rest on the code.