398d6ed1e7886c34ba634bf7fc6b6c02b060a1618fe3041117360767d3636ada

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/nize/bodyparts.vbs
Size 5KB
Sample260803-tht47seq5z
SHA256 398d6ed1e7886c34ba634bf7fc6b6c02b060a1618fe3041117360767d3636ada
MD5 3ce54b628f41e6b343a440d6f6c7ae92
SHA1 c82119d4d2491a08da268d3972e32e8e38883443
SHA512 4bf71ef962504134bed9ec224a52be2049048f3e8e75f81f55c1932ec7a8177341cad91d0d70c8d3f7f68883b197521850b62b455ce4c03b87784317d0c7e29f
SSDEEP 96:J6ArBYT9qgQZL+BUKgQXFoI7j8ft5qfuPqgQIygL+BUKgQXFmI7j82c6N:60ba5blO0WibI45bzK6N
TLSH
T175C11E00AF5F655D3111C58A65A79CC2F13890FB0915ACABBE4CF18C3B2905E8BBD5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5924	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pawno\include\nize\bodyparts.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads