Overview

overview

10

Static

static

1

request.vbs

windows10-2004-x64

10

request.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 06:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    request.vbs
  • Size 4KB
  • Sample260820-g2fdyafm91
  • SHA256 71fbffcbab0e585ae33ff277a076366955661e39fee25b62c9f59392263025b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 43 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\request.vbs"
    1⤵
    • Badlisted process makes network request
    • Downloads MZ/PE file
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\pysetup.exe
      "C:\Users\Admin\AppData\Local\Temp\pysetup.exe" /quiet InstallAllUsers=0 TargetDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=1 Include_test=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\Temp\{748FDFC7-5563-4984-A71B-863011E9EE28}\.cr\pysetup.exe
        "C:\Windows\Temp\{748FDFC7-5563-4984-A71B-863011E9EE28}\.cr\pysetup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\pysetup.exe" -burn.filehandle.attached=588 -burn.filehandle.self=584 /quiet InstallAllUsers=0 TargetDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=1 Include_test=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2168
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5520
  • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5172
    • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
      "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800.log" InstallAllUsers=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=1 Include_test=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
        "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800.log" InstallAllUsers=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=1 Include_test=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4380

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a00a0.rbs
        • Path C:\Config.Msi\e5a00a0.rbs
        • Size 8KB
        • SHA256 d94fe8c342fe16308477754c38aa5a51a019011c179c9d2df7ab237b95512f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00a5.rbs
        • Path C:\Config.Msi\e5a00a5.rbs
        • Size 12KB
        • SHA256 79317bcffdd9906eb66193360b80e5336ba5440524b3ac33c251e5f200bf3dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00ad.rbs
        • Path C:\Config.Msi\e5a00ad.rbs
        • Size 14KB
        • SHA256 cf49ddff9e83b9c8b1dd0c3bf14c4074c3a76b4de8fc58058f18cb4237bdc4a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00af.rbf
        • Path C:\Config.Msi\e5a00af.rbf
        • Size 100KB
        • SHA256 624bbc0586d8855633b875e911883bbef8a0e8b8711e11126df480dd86f54181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b0.rbf
        • Path C:\Config.Msi\e5a00b0.rbf
        • Size 99KB
        • SHA256 efa5cd364cc2a96ae0ed75667f24ed886eb56054fe9223fe052f27daf1f38b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b1.rbf
        • Path C:\Config.Msi\e5a00b1.rbf
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b2.rbf
        • Path C:\Config.Msi\e5a00b2.rbf
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b3.rbf
        • Path C:\Config.Msi\e5a00b3.rbf
        • Size 36KB
        • SHA256 e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b4.rbf
        • Path C:\Config.Msi\e5a00b4.rbf
        • Size 1.6MB
        • SHA256 231edb546ac465eae75990eb3272903a4f083af3dc3bf18301375cb19ca12c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b5.rbf
        • Path C:\Config.Msi\e5a00b5.rbf
        • Size 74KB
        • SHA256 150c470f9943b806b44312efdec85755f22f8d7d52b31f93a9af3c43e8627381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b6.rbf
        • Path C:\Config.Msi\e5a00b6.rbf
        • Size 76KB
        • SHA256 fda28a734788a3f175cb6aed4daeb5f05f0e49f6a272ccd2051ba337f7b3b42f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00b7.rbf
        • Path C:\Config.Msi\e5a00b7.rbf
        • Size 81KB
        • SHA256 c4ec1845a5724b2a83500f3bd940355e2fe26efc6b4fe6c208365359a6130da1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00ba.rbs
        • Path C:\Config.Msi\e5a00ba.rbs
        • Size 8KB
        • SHA256 2defb48be07921a9716a3258f69e7f38b3dfcd9ec910102509342869d6a578f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00bb.rbf
        • Path C:\Config.Msi\e5a00bb.rbf
        • Size 66KB
        • SHA256 a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a00bc.rbf
        • Path C:\Config.Msi\e5a00bc.rbf
        • Size 6.7MB
        • SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        doc_JustForMe
        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
        • Size 5.4MB
        • SHA256 02cc5a3a1d6c54390d68ee97f6c08c2a061a457780e48919c29462ef95a92b09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lib_JustForMe
        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
        • Size 7.3MB
        • SHA256 af7b6e1b27c6ee7a2e40b947fda039ad26827ac12ed4d0ffa80a6576f5b5fb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcltk_JustForMe
        • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
        • Size 3.4MB
        • SHA256 f0d5c603ff7d87412f5a1e45e8ab7bd95d6f40bb90fd107125964421d7f06233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        exe.msi
        • Path C:\Users\Admin\AppData\Local\Package Cache\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}v3.12.2150.0\exe.msi
        • Size 712KB
        • SHA256 91f05b779c2bbeb7a371c2ca24f600d8c21664ad8d2bc464e5565bb90e9405d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        launcher.msi
        • Path C:\Users\Admin\AppData\Local\Package Cache\{3B36061E-A25F-4E12-BFD1-68E724723D48}v3.12.2150.0\launcher.msi
        • Size 540KB
        • SHA256 6601eff4c1be13cf21106cdd8f041f96e4f1648aa683c73c53dad157ff12676e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        core.msi
        • Path C:\Users\Admin\AppData\Local\Package Cache\{4534F2ED-1616-434D-98A6-0DA358DCD466}v3.12.2150.0\core.msi
        • Size 2.0MB
        • SHA256 e747ceb205400dcdd45cbedc372f9c3cacdd158277e4d27ae1b95d223e323918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        path.msi
        • Path C:\Users\Admin\AppData\Local\Package Cache\{D552469C-E810-468F-A139-1EA43D0E2BE0}v3.12.2150.0\path.msi
        • Size 48KB
        • SHA256 ec15dd792ca665ffbe9107883a4ff4ba11d4fcfc0ac87c0a41b401f6d77c3d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dev.msi
        • Path C:\Users\Admin\AppData\Local\Package Cache\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}v3.12.2150.0\dev.msi
        • Size 384KB
        • SHA256 633283cfcc5e870c6ce19404267a5e0509625b6b106d0c68e7133557d5c1bcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800.log
        • Size 78KB
        • SHA256 5b6c78f1f9befad99393675c970ea7c809201d90a25035bbd1ae1e2bdebd5c76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800_000_core_JustForMe.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800_000_core_JustForMe.log
        • Size 3KB
        • SHA256 4eb6f06054276547e0c59cb92ae0f23da5cef650900ca3c1a649574bf81ad877
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800_000_core_JustForMe_rollback.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800_000_core_JustForMe_rollback.log
        • Size 1KB
        • SHA256 a25234e62778694691f0e52bd9d78ed88ddd5da682dc9a14a5467a889c438377
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800_001_exe_JustForMe.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800_001_exe_JustForMe.log
        • Size 1KB
        • SHA256 b1d3ef7a1854c5f2df6c1402c18f101c712a342b36ce3f9c00f46f6fe06d6aa7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800_001_exe_JustForMe_rollback.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800_001_exe_JustForMe_rollback.log
        • Size 1KB
        • SHA256 9d1c00e5513a64c015768c19af9fe5a9f9d3a476e73f3b7ad073b242673b7f6c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Python 3.12.2 (64-bit)_20260820071800_002_dev_JustForMe.log
        • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260820071800_002_dev_JustForMe.log
        • Size 1KB
        • SHA256 1e10974970f65a8aea483d9b9dc5ee0f87357087fe86e1dc4883d47b8221b0d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pysetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\pysetup.exe
        • Size 25.4MB
        • SHA256 b9314802f9efbf0f20a8e2cb4cacc4d5cfb0110dac2818d94e770e1ba5137c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Python 3.12 (64-bit).lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\Python 3.12 (64-bit).lnk
        • Size 1KB
        • SHA256 188d5683a33d7bc70ba67ccaeeee70d46cdf2ca7f8dc0e3d13b28b269c26f12a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pysetup.exe
        • Path C:\Windows\Temp\{748FDFC7-5563-4984-A71B-863011E9EE28}\.cr\pysetup.exe
        • Size 858KB
        • SHA256 1474dbd6a33da8f2f0b50007ba48f0c1ddb3e0e6f8c969722eed1e683a9af68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PythonBA.dll
        • Path C:\Windows\Temp\{8D997CFF-066F-40DB-8E1F-F413CA3BEF11}\.ba\PythonBA.dll
        • Size 675KB
        • SHA256 565f03893da383e5bec8c6eaa7c8fbb3e6db0b9bddd5a1399b0dec66fa44d64d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SideBar.png
        • Path C:\Windows\Temp\{8D997CFF-066F-40DB-8E1F-F413CA3BEF11}\.ba\SideBar.png
        • Size 50KB
        • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pip_JustForMe
        • Path C:\Windows\Temp\{8D997CFF-066F-40DB-8E1F-F413CA3BEF11}\pip_JustForMe
        • Size 268KB
        • SHA256 cfe1f73cd965e2cf1bcb94143fd87b7a6cb0d315977cab1da3002f5029948b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4380-513-0x0000000000780000-0x0000000000809000-memory.dmp
        Download

        memory/5032-514-0x0000000000780000-0x0000000000809000-memory.dmp
        Download