8266312e9c7249e8d840f8b4e587de90bcfd433b00e08ca81ebf092bd8fd5c57

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 15:03

Target
EcMenu_v1.6/Files/StickyNotes/StickyNotes.vbs
Size 778B
Sample260508-sfbdmsdy9p
SHA256 8266312e9c7249e8d840f8b4e587de90bcfd433b00e08ca81ebf092bd8fd5c57
MD5 6036af57c7a434a72c39d0e35be4c02c
SHA1 8eb40c2cb785f87817ea0a4e914a753fbabebbdf
SHA512 9b02fa83713d7921e8e6fbcb21ef4337f7bacc2ca6b9dd69bc577eaf65c89cbae638613ec1648e79f3e026224302072004f46c90b9bab14515ff659dfe33f35d
TLSH
T11E01DC109E06C39B107EAB521BF2F49A82B24A15D8A0DC0CBAD9D5ACF483C0993718BD
MD5 SHA1 SHA512 TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	WScript.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6132	StickyNotesStub.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EcMenu_v1.6\Files\StickyNotes\StickyNotes.vbs"
1⤵
- Modifies registry class
PID:5544

C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe" -ServerName:App.AppXkqfs6y78jh7hq28mk2c4s2qpre76a7s4.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5084

memory/5544-0-0x0000026E529A0000-0x0000026E52A4E000-memory.dmp

Download

memory/5544-1-0x0000026E54390000-0x0000026E5439C000-memory.dmp

Download