5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EcMenu_v1.6/Files/SnippingTool/SnippingTool.vbs
Size 721B
Sample260508-sfbdmsdy9p
SHA256 5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d
MD5 198e2203276744b37ed3327009580034
SHA1 c71bc0697d73bfb68bdefec640be4b26a004f491
SHA512 65622e0be3f99678c34db5b98886d2569ad0534f4263c3aaa80dd103e446b48650a0f2cfa741418832483874a2da35bc104ba7c1931953ed101097eaca0de58f
TLSH
T1EF01F4109E05C3DB107EA79217F6F45E42B14614D9A0E80D7BC9C5ACF043C08437057D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2564	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EcMenu_v1.6\Files\SnippingTool\SnippingTool.vbs"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-0-0x0000017CA3F40000-0x0000017CA3F4C000-memory.dmp

Download