694f4396e4890c01103bdb3209039e3a935edcaa5062100e4ad574060164a32e

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/nize/YSI_Visual/y_areas.vbs
Size 85KB
Sample260803-tht47seq5z
SHA256 694f4396e4890c01103bdb3209039e3a935edcaa5062100e4ad574060164a32e
MD5 d527ef014b14c13610d19b36eadd892e
SHA1 3915585d52a153701f896b3309d3b2330fc804ec
SHA512 f9fb5d17f148da37eb3b2d8a5e060c373d17f5c76009752b3574a30f031b714e503a0f16cb8d274876da5a6ee75806f1032b9101b141e91d457d6dfe53692b77
SSDEEP 1536:/bkSitfXXs+FgFkFFFAvT0G90V22nFRyACyAl:Infe+7irBc3nFReB
TLSH
T1558371AAFE2D8B0E0452C07CB94561C5E20D67765B2E4CEB7B8DD798BB0815803BCDD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2052	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pawno\include\nize\YSI_Visual\y_areas.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads