146a9507c216cabfab807c22a12d1a4a5140b20b96fbb40e140510c3a0099599

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pg_cloudconfig/Vagrantfile.vbs
Size 1KB
Sample261113-e1q3yafw3w
SHA256 146a9507c216cabfab807c22a12d1a4a5140b20b96fbb40e140510c3a0099599
MD5 07d2ac7ddc106b450c882554ea8a0a93
SHA1 e50167131ec195193d710374e07577a0928df888
SHA512 a3d92641f4af97942eb4a1900c4bfcf71b723f7cf042953c834ff8d84976d56ab6b6efa8fc88c45975a22517d7a33e42d2836b37290e7624be5fe37f72eede1b
TLSH
T1CE1112374017AE3F3FD9CE52F5F2E6281E95D5E7124F085C76AE30290F0A558A6A2701
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5308	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pg_cloudconfig\Vagrantfile.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads