c45635b582af74b13422a0af8b3032f0dda6df9888b55549f0f42beef48eff65

Analysis

max time kernel
22s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.vbs
Size 2KB
Sample260919-kk16vsdc57
SHA256 c45635b582af74b13422a0af8b3032f0dda6df9888b55549f0f42beef48eff65
MD5 3afd66816397dd73cc2492d14bbb10f7
SHA1 d7772eea69c2d65820f53cf0c6e1c17d9e1d9cba
SHA512 d3724d37e341e4b3d0816dff5cf70001bedd32b56fdce6f629bd9abaab716770c4d4ec154fa90949d8bb954c5c8822ab480f2321057c72a3d4d390ebb347a848
TLSH
T1E6418506BC1B8C644D32C77A2677A00FEAD4E503B1338C68B69C4D035FB765A8D55696
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
3040	wscript.exe
1592	WScript.exe
5952	wscript.exe
5956	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 5952	1592	WScript.exe	89
PID 1592 wrote to memory of 5956	1592	WScript.exe	90
PID 1592 wrote to memory of 3040	1592	WScript.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs" worker_cpu
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5952
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs" worker_cpu
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5956
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs" worker_ram_disk
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stres_test_temp.dat

Path C:\Users\Admin\AppData\Local\Temp\stres_test_temp.dat
Size 47.7MB
SHA256 91a431b335086e06799e44e440bd698f14b9df1672de8a8b7a9b28d9c184a3e6
MD5 4cd95c67f6f3a5e69ec6efbc72756160
SHA1 698031e699bab82f4788862ab8610e1b508052af
SHA512 2cdfa041560c26dc5513ef36c9cef9a72302f845ca2e339e1683a8dbf1afa12b9ad634133b6762ea55485be91f3bb4f362dd8d9e14746f2ea06de9624388500e
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download