2186db6837aa97b4162a6c094383fec769201670e59bded119a6dac42525521c

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
149s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/nize/YSI_Server/y_colours.vbs
Size 11KB
Sample260803-tht47seq5z
SHA256 2186db6837aa97b4162a6c094383fec769201670e59bded119a6dac42525521c
MD5 5fcc0f8fbf6a9316baefca863861ecf6
SHA1 5688ff0adb0e64724be216fb6092640a2fee257f
SHA512 d7b71060cec1c44437eb7a51901314ac4c50976bb369c9cadf56a57f1162a27fa1bcde20fab36b43a372a65b0622bd951d9727a6b5394722f9c30d09e8aef68a
SSDEEP 192:Pd3xHKaejyqCEqGhOuWqn5Uj3XrhX5uLxUyCWrdjtHbgE0Igr5AXi5ppD0+4SD:PF4YGMRu9jRHcoQAXKD0+JD
TLSH
T15132A6B8EF9EC2753573052E580CD6A0410FE97F662A58E9BC5C810C7F42169B2B9C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4824	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pawno\include\nize\YSI_Server\y_colours.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads