b1df96263ccbda8a94a0f8e17a012ee6fb7baf11c9e6e4f39c3db33717fad54c

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSign58.vbs
Size 1KB
Sample260629-1ebxsagy6m
SHA256 b1df96263ccbda8a94a0f8e17a012ee6fb7baf11c9e6e4f39c3db33717fad54c
MD5 cd2e4592e34aa81ec3914c5eb1b5b5e1
SHA1 594cd126098b2d4d7ac9f403b471e41f98a29e30
SHA512 4ceda3e18ec4b6e98441b72cb7f39b5bf28afed2bc8e2b59f4ecaa99daf9541119bab181a5dfd73f811d485c6edc2975da689145be06468b6b2b149945432693
TLSH
T12331241F2D4BD270217D4A864F13F8ABE7A2406B5002C459BA8DD8541B3DD6A5BE51CF
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4876	WScript.exe
13	4876	WScript.exe
14	4684	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
4876	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4684	4876	WScript.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DocuSign58.vbs"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Part3.vbs"
  2⤵
  - Badlisted process makes network request
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Part3.vbs

Path C:\Users\Admin\AppData\Local\Temp\Part3.vbs
Size 4KB
SHA256 729c61c70f7cc192fddd718e69475b5f0a17a53b20b70f339077f924c5b9cbfa
MD5 09f068b4d0ae9777cc2d2772a2c330c6
SHA1 c62dc33341c009784ecd40763bff1895dd235f19
SHA512 768c986c67bcf3fe58694edac081a11db006cc1af3c8b90e6930c03acb155a6879894da63ad4ef785bb8bcdf35eba6a1587f1b4c5202e369a340fe8e55c19b31
SSDEEP 96:0nAbYHgPwGAxUbMqNUSQtgOVdqCaIqral8kAw1j1PtRyRwnXn2nqnDMn+amAWPtC:0A8HgqDqN+fVcCqrXMRbZRc
TLSH
T18691633BB701C13450B31563F351A81EEAF6D10B3511B019B6CC885BA736DADE5B0AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download