ed1f4fa45a5fd01bb1a736ce589b232a9a5c8a1010ff9d50fc2a2b6d448944e5

Analysis

max time kernel
148s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rkss76324.vbe
Size 56KB
Sample260804-p29a1sbb86
SHA256 ed1f4fa45a5fd01bb1a736ce589b232a9a5c8a1010ff9d50fc2a2b6d448944e5
MD5 7d61286b630060224b0743bc002736e0
SHA1 e6e6adbb89c0e1bad39dd2c175da0db46c3b999d
SHA512 5f4f5dbc7543c929983cd84927636eb18191a32376aa810833a1b39bc53df8f0a32e4b665c6c9697708da5b0e6eede444ef895e490bdd640a7ec39a575f9fb8c
SSDEEP 384:zRoSOK4rYu/a/Qi1aPCWInZsvKxY6OhTcOo5XFc9lddMsjrdBpfXSlr3CzyxJcfz:z4aPMIN8ysBfXS9w3mf8wOP/6E0Op0Q
TLSH
T16143C974190558D78113BD01E9431AA6CFE8D21326EB1FB9C340A6CA079E7D7C8B6DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	2868	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2868	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rkss76324.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads