5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d

Resubmissions

03/10/2026, 13:36

261003-qwlhfazcre7

03/10/2026, 13:33

261003-qtkhcsdd977

Analysis

max time kernel
40s
max time network
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SnippingTool.vbs
Size 721B
Sample261003-qtkhcsdd97
SHA256 5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d
MD5 198e2203276744b37ed3327009580034
SHA1 c71bc0697d73bfb68bdefec640be4b26a004f491
SHA512 65622e0be3f99678c34db5b98886d2569ad0534f4263c3aaa80dd103e446b48650a0f2cfa741418832483874a2da35bc104ba7c1931953ed101097eaca0de58f
TLSH
T1EF01F4109E05C3DB107EA79217F6F45E42B14614D9A0E80D7BC9C5ACF043C08437057D
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4464	WScript.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SnippingTool.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads