678f891615e2209a8ecba17857922a9723e78709adb983032e89ca706000c44d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TKEWorkloadTool_x64/_internal/_tcl_data/word.vbs
Size 4KB
Sample260905-eed69aek7z
SHA256 678f891615e2209a8ecba17857922a9723e78709adb983032e89ca706000c44d
MD5 70450a0cf04ef273eff2b070053fcfa6
SHA1 47974d6c0fc986ee1273c4e13ddb9e1288cef0ff
SHA512 afd3e47324d1497cc46ac6141191fceb843977d0b0285c807ff8985dcc56fde10977f57d503d986cd2c1edc6c62f01e405a0eb483340b247b129fc8d6d9fe689
SSDEEP 96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
TLSH
T1A0A154D29646132E5FB2C119E9DDB379FA0A053A03FF412170ADF1582B6655F083ECE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4592	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TKEWorkloadTool_x64\_internal\_tcl_data\word.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads