44b95d462468cff31aabb7b294a25752592dd46219deff1d31be8e94e73b5c67

Analysis

max time kernel
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
376020250609_447129jtgtTransf-560290ttvyzx-993155154686-Trib.vbs
Size 3.9MB
Sample261110-3aqaqacc69
SHA256 44b95d462468cff31aabb7b294a25752592dd46219deff1d31be8e94e73b5c67
MD5 e822ed13e5b1b6dda7127b363e069e45
SHA1 dc65f12a470ffdc831f5dd5cd3b682bfe410f201
SHA512 320e61d4f452c92381d037f7f448a7e3b22a723982ef764ea7a4ae6f75f9e59e16ae4e5d3bb0eca76317968ad37708decd3c8c737c9f4f4cc786af96d7b77613
SSDEEP 49152:pDwjah9bV8z1mTSaxbhqe/QLim0rb+wRQ8cbq8IC5q1BQ0AJTlfz9FG9FoT4uY:W6D
TLSH
T14016F137A7A8010B05E1476AF10A6173FE7BC423874D82A5DC9DE22935DB4EEC27E5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution persistence ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
3872	WScript.exe
4676	WScript.exe
5152	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\376020250609_447129jtgtTransf-560290ttvyzx-993155154686-Trib.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3872
- C:\Users\Public\[email protected]
  "C:\Users\Public\[email protected]"
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Public\EkRReibBvyh.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4676
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Public\MtBarulfYz.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EkRReibBvyh.vbs

Path C:\Users\Public\EkRReibBvyh.vbs
Size 571B
SHA256 524dfed5d2de60441a862a52359ce4697a1c5bfafbd1e394595babc1e0ebb10c
MD5 83eabb93d24b27e3cace41dffabde5c6
SHA1 53fa06dcc1b29515fb5af9f87e1f60a916a6be9e
SHA512 56f34e8fccfd4bc65ea3ff1860782b58b91ba790d8885cd03c2470467d10cc60614acc31f2ef707ad80b0f41b3b204aeef605c04cb84cff66d3b5f7dbdc9a16a
TLSH
T1F2F08103AD24C0865CF0640377F1E52FADF5811E223787145A55C4452F64C39068E4B5
MD5 SHA1 SHA512 TLSH

Submit Download

MtBarulfYz.vbs

Path C:\Users\Public\MtBarulfYz.vbs
Size 570B
SHA256 bbeda9f35e74f6b09206b4af0c77973efea6a3867e92e5606429dc40729b9e25
MD5 b99a4269ba794d7a24b8bec328dcbbec
SHA1 cb44a5f7b8dfab3243c959447d6fa0a913ea5907
SHA512 910773a4ec326e4e9bcb27be074ea162cd60be4f22a99a8f7295b76120342acae3440df5106db1491ede11bc5a1172af4466ef382296d778740404c40b37e602
TLSH
T1F5F08B03AE20C08A5CF0280777F1A63FAEF6810D263797186B95C4492B64C39068E4B5
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Public\[email protected]
Size 2.0MB
SHA256 702254a7088ba1f75fbce7458a5a1e8a284e36b6df968c2e49e3e1c05dda6ea6
MD5 6af0169906e95981032277f245b5004e
SHA1 dea025b3ee831534ab9cc93a4b2ab43cf99e5660
SHA512 43aab7258cc5c925086f646ae1039767a746cc460a1cdc85adac66284f3ebb071dd95a22b5399ab9f4d23b0e0ad3b25b111e9a078b5ec94f03a22b94d7a6c3e1
SSDEEP 49152:5H/FbfPhNRhbcN0quMzwdRo4TlFXoQ4cQ7GOzYMEjpH:bbfP/Rhbc2P7UcQyfpH
TLSH
T1E8A533D91F47B389C01C7BB2A3A114A94F5B02D835A6DF660DF6AD4BBC23E414EE1C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3432-51-0x0000000000720000-0x000000000536D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads