0662643bf41826545f83bac7e74c9988413267a0e74d562b2392092f6fe3b1a6

Analysis

user interaction
yes
max time kernel
298s
max time network
291s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
t.vbs
Size 32KB
Sample261002-w5lgpafg86
SHA256 0662643bf41826545f83bac7e74c9988413267a0e74d562b2392092f6fe3b1a6
MD5 ca659f96e069a068b13171018a078789
SHA1 c4fc10cdb26e2d37f45832f9555ac477977e012a
SHA512 2a6770e4ac029496afa82539d4a90532e9d5f6bf6bb9e3e5883f3458ab376b77156061e2284c162e53c9ad70ba5e857185dece20b6f9d97696b20664b419a038
SSDEEP 768:+TGvAk0Mqqo8IgldBNTK7171vDjgRWrNM:+TGvAkw8Iglo7HvjrNM
TLSH
T142E28119BD0CF6FC1D6C8A034E6BD43C4FC01EAAC152B885B770A816A9361ADEE550DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1472	WScript.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1472	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
956	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
956	powershell.exe
956	powershell.exe
956	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 956	1472	WScript.exe	90

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\t.vbs"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep b -nop -Command "iex(Get-Content 'C:\Users\Admin\AppData\Local\Temp\v.dat' -Raw)"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v.dat

Path C:\Users\Admin\AppData\Local\Temp\v.dat
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/956-4-0x00007FFC6340F000-0x00007FFC63410000-memory.dmp

Download

memory/956-5-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-8-0x000002CE73960000-0x000002CE73982000-memory.dmp

Download

memory/956-9-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-10-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-11-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-13-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-14-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-15-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-17-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download

memory/956-18-0x00007FFC63280000-0x00007FFC63C24000-memory.dmp

Download