d4971d87f7d0e94f302ac708a733f9e0166eba8daa4a5e0c8e41ac580643ff8c

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EC_puller.vbs
Size 2KB
Sample260807-gl4ftsybkb
SHA256 d4971d87f7d0e94f302ac708a733f9e0166eba8daa4a5e0c8e41ac580643ff8c
MD5 a1c249edabd90e696d384eb76cc1592c
SHA1 f27387c596409e65503d9c1aa4e1133839eb80d5
SHA512 a04c8583acd9a9ac56978272cf136c8022b4269a639cc08e92f3d2eacb0e6dcae12edcb34d1d17597b48a06d6952f4c98761b482e24b1dde26bd83d664c04113
TLSH
T13651334A6D2790D22CF7EEA1E623651CE9319416BD7B4D3F3C90E48C4B1DF79944408B
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5368	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EC_puller.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads