80decc382747101619046e56b2ad30a76c20df226b066825c40aa577d72697cf

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/nize/YSI_Visual/y_commands/impl.vbs
Size 54KB
Sample260803-tht47seq5z
SHA256 80decc382747101619046e56b2ad30a76c20df226b066825c40aa577d72697cf
MD5 6b9e29952abb3afe5d0041175908800f
SHA1 b7cb1daefb5a0bcaec11832f959064c910b99524
SHA512 41a3a1934d8df56d08c892ba2bb0215ed150bc765dc9d01dba4084bffcb960b14b777130da856aa606f086b043ddf2ca548b448896fd1bf58e8f0352b5efbf7d
SSDEEP 768:CYjDlfjq6hLADJTouDwQUjl0VwQEaE4+105fREUEmoE7Ea2PEDEMLEDrED7WLE2L:rfjq6h0YpjCo23dKCiuaPKNsTea
TLSH
T135431E165EFDCA160012C2388B95D295EE9AE33733354CEBB96D3C185F1C29592FCE89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5128	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pawno\include\nize\YSI_Visual\y_commands\impl.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads