71e76557fdef682a9d8fbc31830c495510774f6045bd9e5c2d2ec877cd01f6e0

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toma6672513.vbe
Size 60KB
Sample260820-js3tzssdng
SHA256 71e76557fdef682a9d8fbc31830c495510774f6045bd9e5c2d2ec877cd01f6e0
MD5 a8c64effa36df4bed293fa5c228baea8
SHA1 1461e8ff3c15418dc641b9162ac6eec8f46d61bb
SHA512 8a4de21040172486394cd0223b57f3859b549b724a26334d245e138b928de2a20b690da28a46a1b55fae84a33eed24e59610e3dd2c402e4df411fd0ec885a41e
SSDEEP 768:nuSMfCOr2uAAuDZ/y2hvVyU/X+fxYRr9DF9veCG:nuSMjsAuDtyvfxYRhDFg
TLSH
T1CE530EF20D8CB2AB426BAC697B8301E4E1AC751847FC6151FB4C5DC1292F163F9ED5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2548	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2548	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\toma6672513.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads