bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowMeThis/_internal/_tcl_data/clock.vbs
Size 129KB
Sample261012-snfckadh92
SHA256 bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762
MD5 31bb1cacf5d128f77c0922800d3e111a
SHA1 93262bdfa958cd64906fb8c24db59294730c5747
SHA512 a156698c7dd9ae3dfcd2512e59a0a382027a23b52330191464f00d6efa96a22bead2d7c470f0f44b07a2dbc209a2451eb92ca91355ece75f0e23084b9e2848ca
SSDEEP 3072:Ybn4IdhYvuCS9epsF4AzqpSMpWzP7ejMiIAEBsq6UkPAPaZqHYM8EN4LhVLAMrXl:Ybn4IB9epsF4SqpSMpWzP7ejM/NBsq6P
TLSH
T1AAD3A6027F19412E71B2D3364ABAE198DF2ED1B776AB805CBCAE405C3B1091446BFBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
824	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WindowMeThis\_internal\_tcl_data\clock.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads