205ba71fa1d9e77e52788c043ecd6a51482d1ddfcad8129744139de5d9c5cf79

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PT137378_5342__________________________REF-2O9YU0.vbs
Size 3KB
Sample261023-lnzb4sxtf1
SHA256 205ba71fa1d9e77e52788c043ecd6a51482d1ddfcad8129744139de5d9c5cf79
MD5 d21dfdeadc0baa585fc7883797e3f7cc
SHA1 9e0f14aa0e5b8e548547975a1a82c927174bd728
SHA512 386e0e88b0af7be7aefd0328b5cd7c13b920a75f873869af1b64b8b5590a532423506d045a8d0c477c3c5242b89eb2acb92ae141615dbd21631a9f042a8c69d2
TLSH
T1DE61849223240BB0A7221EDA9897611956F0D067330C0669FDEB9AC73F3AFB17F45931
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3568	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3568	WScript.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PT137378_5342__________________________REF-2O9YU0.vbs"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads