a640827ca1f7ce2a671b453a94b783f4124217d6e053d770e8873c895a8c39bf

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oii.vbs
Size 693B
Sample260831-ag2ccasdnh
SHA256 a640827ca1f7ce2a671b453a94b783f4124217d6e053d770e8873c895a8c39bf
MD5 7b1e85d5ad61c4b0d835d8f40f77be2d
SHA1 dfe55ad559eb59656112f67d1baecfcc73d6a7de
SHA512 cd32e7d0cb0ee3afdc6a106a496945a52f9e406ad2dc16834c85446d68279787942ba406d3c79665bb93b750e73ea3a69c7c61b192c915f68cf812b7aafe1e2d
TLSH
T1C4019E2FCC65DE21811A41F75973CE4F4764955D6418D0B9EA62CCD4E1DC2280D7B3C6
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion evasion execution ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2548	bcdedit.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4300	WScript.exe
3888	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2292	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3888	4300	WScript.exe	89
PID 3888 wrote to memory of 2548	3888	wscript.exe	90
PID 3888 wrote to memory of 2292	3888	wscript.exe	92
PID 3888 wrote to memory of 1788	3888	wscript.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\oii.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\oii.vbs" /elevated
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} path "C:\Users\Admin\AppData\Local\Temp\oii.vbs"
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2548
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\pay.hta"
    3⤵
    PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads