42a5253a86c78ffcecee5204516d3649db9025e2bc2b9f0df65fdb4f8331afdd

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/y_areas.vbs
Size 86KB
Sample260803-tht47seq5z
SHA256 42a5253a86c78ffcecee5204516d3649db9025e2bc2b9f0df65fdb4f8331afdd
MD5 0a7384d4fa4428aaef127370fcabb543
SHA1 ae1ee9ad66feb16fae0a15bbfa4ca2e581a2c767
SHA512 7ab406fd45fc26bc267a3c33fa85c36cd30c19f69ca505d93a6c1e12cd4a29d33c4ccda31b610b05a7b358f9800b7c9057646be82ee0a427c16f0805376bf3b1
SSDEEP 1536:7wGitfSYX+FgFkFFFYeqsFWTPVpqn+QcpbLgJ:7olOe+7XRghon+QO8
TLSH
T10D83909EEE1E8B0E0452C06CB84572C9E60D6B744B2E4CDBBB4DD7A8BB0D10952BCDD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3760	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pawno\include\y_areas.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads