ded4cff7af7751f7690193d9bdba04b83dd8415128e5ba78f80d9927aaa43f59

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Core/checkduplicates.vbs
Size 2KB
Sample260724-g48hhateph
SHA256 ded4cff7af7751f7690193d9bdba04b83dd8415128e5ba78f80d9927aaa43f59
MD5 c3c5f18e234a0c28a74b45b195e9c123
SHA1 41ffa37ad9a78d423318a4c523eaca4120f8d08d
SHA512 860db34e49cfceb9c77e983cb4aa63750013b41bdb04fec112c523c8e7bb7af8caf9c741c9b964831b2eb5d75afbe8f4bdc838dcc17be8dfb95c48ae02cd8d58
TLSH
T19F513E85B2C3A939C142E5A0A5A0D3486FFC6401EF058CBCF7AAB597B214C5AF83598D
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2716	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Core\checkduplicates.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads