f99168fd638f0e3b7ccbe9941cb1192954f4b1cad0bb0a2f956b3facab1e16bb

Analysis

user interaction
yes
max time kernel
229s
max time network
183s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
baimingdan2.vbs
Size 6KB
Sample260810-phgrnahj2s
SHA256 f99168fd638f0e3b7ccbe9941cb1192954f4b1cad0bb0a2f956b3facab1e16bb
MD5 7262d5f212117c40cd05810089068fd1
SHA1 876e1013eb2cd88b1ee38c1c9083a84a2bfa049f
SHA512 74182b835101ecd3d1dc4f6e4be28fbf7d3d9e74d45f3e6381ef9b76387d13ce337574058dc5a00cf1f4e99cd5bd1f8f6c4bf709867d09009e0c102292278d25
SSDEEP 96:SpMGCOvm+dnPKZGL0G92ZG+Vwr+OcbjXeu57uPnZi/jdi0+p+j+um+P+noq0I5t1:S6GOpMe3t9reu57uPnZirkZ8SmGomh
TLSH
T104D1B30097FA2544B6F36B44EE7680294B73BEE56935CA4D4588088D0EBBE408DB6F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4316	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3628	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
500	OpenWith.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe
500	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 3628	500	OpenWith.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\baimingdan2.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\baimingdan2.vbs
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads