5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287

Analysis

max time kernel
14s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287.exe
Size 506KB
Sample260719-3hlx9sax5s
SHA256 5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287
MD5 7cd44dfdd8ea0c997b623a3ea4df2c8a
SHA1 f20f1d7ae28cc47f29aeb4246883e39d51f56667
SHA512 492f017c6a4d08f036fc19ffa9697c6ccd29e4957bc3db1a11fd0484e37714b34c15c0df85ab45039f6871d9862fc1dc124c7f05dd10e4fea0f3eaff68434bbd
SSDEEP 12288:iq4DFmFIWaLhB1n9XxgRtBfIY0CHYn9Lm11cNmwRUFflJ:iqPFDarp9hgRg/hIwswufl
TLSH
T1C7B423778ABABB25C5695D3E4ACEAADD870274B409735FC6D4431E5F2AC4A44C023ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence upx

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4528	wscript.exe
3	4180	WScript.exe
4	5624	WScript.exe
5	6124	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
624	WScript.exe
2640	WScript.exe
2696	WScript.exe
2620	WScript.exe
4528	wscript.exe
4180	WScript.exe
5624	WScript.exe
6124	WScript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4320-0-0x00000000002F0000-0x000000000058C000-memory.dmp	upx
behavioral2/memory/4320-3-0x00000000002F0000-0x000000000058C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3456	schtasks.exe
4212	schtasks.exe
1472	schtasks.exe
3516	schtasks.exe
6048	schtasks.exe
3976	schtasks.exe
920	schtasks.exe
3960	schtasks.exe

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4528	4320	5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287.exe	91
PID 4528 wrote to memory of 3976	4528	wscript.exe	92
PID 4180 wrote to memory of 920	4180	WScript.exe	96
PID 5624 wrote to memory of 3960	5624	WScript.exe	100
PID 6124 wrote to memory of 3456	6124	WScript.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287.exe
"C:\Users\Admin\AppData\Local\Temp\5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
  2⤵
  - Badlisted process makes network request
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\0F587D0AD3189F051B5219D0026FF8C5\4341134F8DB0AA31134FD1A257E3BA8B.vbe" /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0F587D0AD3189F051B5219D0026FF8C5\4341134F8DB0AA31134FD1A257E3BA8B.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\9450BDA01D73BD6F43B60A4FC7CA1712\4039215983877B34B0446724E1F070B7.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:920

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\9450BDA01D73BD6F43B60A4FC7CA1712\4039215983877B34B0446724E1F070B7.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\DE4AC005141A3BA8536951DB6007964F\7F148E2E7E03958215EB74FA7E2BA5E9.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\DE4AC005141A3BA8536951DB6007964F\7F148E2E7E03958215EB74FA7E2BA5E9.vbe"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\1FDED2D63B794D87E75D610BD84BC212\06ADF46E04D04D6374FBB004618CC8A0.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3456

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\1FDED2D63B794D87E75D610BD84BC212\06ADF46E04D04D6374FBB004618CC8A0.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:624
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\D0BDFE601E89CEBC48587E6FBA811CA4\E6614C7165189D54B4E914C356DFE3D8.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\D0BDFE601E89CEBC48587E6FBA811CA4\E6614C7165189D54B4E914C356DFE3D8.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2640
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\AA55A19083A10EE3DF90187362044102\AA3E3E0F93FF736C1A562256A1694EB7.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1472

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\AA55A19083A10EE3DF90187362044102\AA3E3E0F93FF736C1A562256A1694EB7.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2696
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\D781E5071F10A17487CC4F10E36633BC\61DB1B21386CB7C9FBD8D7E197AE1808.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\D781E5071F10A17487CC4F10E36633BC\61DB1B21386CB7C9FBD8D7E197AE1808.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2620
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\75A690A3867A84C3832605CD218DA873\78E31CFEE032687C98F1F378698F6A82.vbe" /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pack82.vbe

Path C:\Users\Admin\AppData\Local\Temp\pack82.vbe
Size 1.0MB
SHA256 7138a648e83aaa97eb31b98c9bfc4e9ccacde6d192e4f9b517572fe11335a724
MD5 862c18d9ae0274490abff6a542b8a3e9
SHA1 591e2c15f429355ad90c18aa70845342f3b6447d
SHA512 9e5c1aa5fb6a6c0947bcba2a74e3c0d8691a4309c99bfba83928eebc44468af5b4b279f538516d9ed5d55a60feb630bb1356946adaec6981a170a4cb3b1a1f2c
SSDEEP 6144:pXrD9tU4E9asDWGCsLHZKpEU57ihgz4wNAQH2HPL47m2lwixlIwH+aHRh4QJplYS:1DEpZWgOmEMmaEn4yf4bHngso9B3
TLSH
T19D25489547E369033954DE48DF8AE2C60F9272DAAA1F5E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4341134F8DB0AA31134FD1A257E3BA8B.vbe

Path C:\Users\Admin\AppData\Roaming\0F587D0AD3189F051B5219D0026FF8C5\4341134F8DB0AA31134FD1A257E3BA8B.vbe
Size 1.0MB
SHA256 88c9c84f1875ec1b55750c1a4de1bc3c50604f46b49d3e86faa67148b8101581
MD5 c61c6b6b0dd8a8290734b91322fc0e3d
SHA1 08669bbc43d1a1b9c39f5c7d7a25aa04592f23a7
SHA512 152c41ede0f4a15190ae03ada56046db65ddb44c0c5a43de1f8ced8b911bd96116ec85c96ba364d9495477cfc89c88743e438bc14da92b03a24def477cb255e4
SSDEEP 12288:OgviBFWrwgjlzpgUnlwoCcPBpGhUSZ1Ts1KN:hOWBxPjE5p
TLSH
T16035378547A369033954DE48DF9AE2C60F9272DAAA1F5F0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06ADF46E04D04D6374FBB004618CC8A0.vbe

Path C:\Users\Admin\AppData\Roaming\1FDED2D63B794D87E75D610BD84BC212\06ADF46E04D04D6374FBB004618CC8A0.vbe
Size 1.1MB
SHA256 5f6bfe31ff0bdc518f626eda7e16696e0e356d266192646003abb45285cd4c9f
MD5 ef6b52bfa117570f7de9b80b7d666a24
SHA1 03089ef6a208d36747f5bef6c585f6cab79f8fa3
SHA512 b19c024af3c6cbdfc3b94869b287f63886b69762aac883312d4012ba4ddbba2e46801c4d06fb4eca014f30dba565db0f62a58bcd1fa7fec14db133ea425bf451
SSDEEP 12288:iA2VrURByRfC9I6TF+fhVuxAddJr4k+uGR47mK7KI5q7d5:ifayC9L2hVupJE5q7d5
TLSH
T15F35488547E369033954DE48DF9AE2C60F9272DAAA1F5E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4039215983877B34B0446724E1F070B7.vbe

Path C:\Users\Admin\AppData\Roaming\9450BDA01D73BD6F43B60A4FC7CA1712\4039215983877B34B0446724E1F070B7.vbe
Size 1.1MB
SHA256 7e82f6b7a71e274f1c282d4019466d08a91b8d4b58f384a535ae1037da976c84
MD5 5f15f662bc6b512249478618d3e7ca2f
SHA1 dc7624c2012b84787c0926a18fb59bccab0fdaff
SHA512 63014b47d74bdaa87c887cb6df574ca3cf4db2c1f1b0edab66d04b4a213dcfc1849897f578fe44787dd5136d1b26758ce2e22a9c99c7dddce17f3b3cf3beceda
SSDEEP 12288:7o2eS6cIoZrcnkQcwhtXmTt5d105Hels6QlcZO/ujcvQL:U2eaahtOP/spqL
TLSH
T1E335389547E369033944DE48DF9AE2C60F9172DAAA1F6E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AA3E3E0F93FF736C1A562256A1694EB7.vbe

Path C:\Users\Admin\AppData\Roaming\AA55A19083A10EE3DF90187362044102\AA3E3E0F93FF736C1A562256A1694EB7.vbe
Size 1.1MB
SHA256 b14c9d32a03729beeb97f72f4b9e3480bf97b108abc02d7ddb24ae3991c04559
MD5 33f43e62833cf41af41baf81eaec9790
SHA1 c49609243111660da4710d966ddfe3f891881110
SHA512 bd8c800ab3eae38a17eaed09a806bca04fdf2eb4d5f68311261e41f4ebdf8ce6e79f1b16f960b1087dc03908941d1317c3a50c5f9e05c02b540f35f5ce2925a6
SSDEEP 12288:IopoI4xA1d8hj7GMQUB3wtA/Q5R5YBihee:PPxMQUr/1e
TLSH
T12135368547E369033954DE48DF9AE2C60F9272DAAA1F5E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E6614C7165189D54B4E914C356DFE3D8.vbe

Path C:\Users\Admin\AppData\Roaming\D0BDFE601E89CEBC48587E6FBA811CA4\E6614C7165189D54B4E914C356DFE3D8.vbe
Size 1.1MB
SHA256 c06fb6446cac287ba976816cf967a891c6f3837d83a373492f896086d26745fa
MD5 89b71df869b2572893816a5464773048
SHA1 154713cedbf1365226fa34d2fa10bbebf05cf658
SHA512 8e643c9b3c809c2ed80f63ddbbc14f20854a20d59ace43ce35c3fc1cf846e01cd4c88b5e7ba835c8e9109b242c5c15a25b9309423c4c11a51825bced73ceb322
SSDEEP 6144:BfRuAQebRANbDR75SudyAuaO2XPcAAyCcMlUFp5LLmMj7jbPvLVAJJjPcAXPHIFW:8J8uJIHqgb9rLscU5XYRgoIalYzv0W4f
TLSH
T14F35488547E369033954DE48DF9AE2C60F9272DAAA1F5E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61DB1B21386CB7C9FBD8D7E197AE1808.vbe

Path C:\Users\Admin\AppData\Roaming\D781E5071F10A17487CC4F10E36633BC\61DB1B21386CB7C9FBD8D7E197AE1808.vbe
Size 1.1MB
SHA256 fcce62572340a7010dd958b6a7c632c9d757d85fbe16d4888e818683a384982f
MD5 181404af2a4cc3dca2689b0205360e61
SHA1 fac388c0e6716f4c6a1079fd3972860126f2db89
SHA512 6a7f9d14dea072cf80215b899fd724d9cc36305a3cc0239bf579bb60a8eaa61e9443652b0ea9fb57cfd632a1ed7d9fdf9a44e13be25c7a8625035c0c3cb758a7
SSDEEP 6144:wxaku8cIUZAxZfe0tKGH1/9Cn4Gypy3gzz1tD8JfxrBJUXU1o8xTtBVg6ndBh/gL:wwDHfd+t3ZnEel44WwvRCqmCMgw4vJ
TLSH
T1A345289547E369033954DE48DF9AE2C60F9172DAAA1F6E0E4318C34AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7F148E2E7E03958215EB74FA7E2BA5E9.vbe

Path C:\Users\Admin\AppData\Roaming\DE4AC005141A3BA8536951DB6007964F\7F148E2E7E03958215EB74FA7E2BA5E9.vbe
Size 1.1MB
SHA256 70bfe1afbabc8826bae90c4887c9ac3bc16485d11201930c2de113027e1fdebb
MD5 b180096e265e790d2ee419b26aa100bf
SHA1 3faefcdeb86710789dd9f5671d2bfd9c9e7821ec
SHA512 5919782ce0d3da51528d34cdfdf63d813c02816b6a4b0add4cb9a898a18a1caf920b15b4b1600a999f5646e2fc9db20f3e19420703a88bedf694d156a728f156
SSDEEP 12288:ERALdwTzqXy25t0kl3fYFQ5i62dGewBJYloV19z8cIzS:jkzqC2zHxlSodz8c/
TLSH
T10845379547E369033954DE48DF8AE2C60F9172DAAA1F6E0E4318C74AE135C02FDE6B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4320-0-0x00000000002F0000-0x000000000058C000-memory.dmp

Download

memory/4320-3-0x00000000002F0000-0x000000000058C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads