e090a56d18f5624dbcc7c7a82f7e19af600a0d6693d98c781f5774afc693e4da

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Booking Request 1 x 40 HC262038470 SSE2514789.js
Size 777KB
Sample260821-n4physdp81
SHA256 e090a56d18f5624dbcc7c7a82f7e19af600a0d6693d98c781f5774afc693e4da
MD5 39143e970c054275ca7de5bba5214473
SHA1 bbe8d460c87f8bc54dc5714cc488939df9da9fb2
SHA512 f8ec4ba4b7ef717459f561ae0781722cceed7e18f55c138c73c4d7696cc7313d1052799413fcf7d9aa831b106a284ba442e28e738194a545d2353eb713fc0c70
SSDEEP 192:ef0tR4NYk5eo97zi0tqyc1YAmH/UVi3Dm+fuPqS+xxFYR1KUNKifMbg13XrEAPoA:b
TLSH
T110050576C2BD2E3EC4275959CD793C0C9CF054A20B4EF87AED3764C8D97CBA966A0160
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	812	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	vlc.exe

Loads dropped DLL 1 IoCs

pid	Process
2324	vlc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	vlc.exe
2324	vlc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2324	812	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Booking Request 1 x 40 HC262038470 SSE2514789.js"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\8bfa\vlc.exe
  "C:\Users\Admin\AppData\Local\Temp\8bfa\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8bfa.bin

Path C:\Users\Admin\AppData\Local\Temp\8bfa.bin
Size 1.3MB
SHA256 7cacf2dbfe62560b717ec4b0be8c30517bbaa4bc0b4e4c5c364588133cbb4199
MD5 539e6ac3b052c3d9751674ac6f67832b
SHA1 8734312eab3d2aa669e8fbfa6c033f39e84e3dbc
SHA512 cdd9e6ad794148bfb862bd8f65104da5146b1557b3f86b19371d0e833093fd817e1d48a7e642bf36c8620e425a8192b8f6140932de90e7eecd5ab9106155cc6a
SSDEEP 24576:DA2eeTUbiaJcXd3xFmxMOJZx0WQY1gBoFbJWEAvB7G0QqTQ3ftGoHaoRjX0oCZNq:keTt4MHFmxPypY1cQJIvtxQqkvtZ5koZ
TLSH
T1A65533ED2894B083BB66085B6645E82375B2D7FD4CED373609648B8C3DC1D704896FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlc.dll

Path C:\Users\Admin\AppData\Local\Temp\8bfa\libvlc.dll
Size 1.7MB
SHA256 449248fcd5677d7369b62428273ba2c1da5ff8c4779e3ee82d0af4d6760ae649
MD5 b660a5a7496f90dfa56a7165e4540006
SHA1 4e385e01ec706092fe35d2e6f3155c6926792e23
SHA512 ede6cd6c8d4efae3126daea721ae1f32d57681ceca40be2f852c5833c22a20d2b8ff6d41858c625a32d31b3936aa9a80e975dd4c5bf5b38440c27c7d83bbf250
SSDEEP 49152:NXgq0R4Gk/eajeQxN4T6scnVkov1X4wf+:ELk/Den6scnVk25df+
TLSH
T13B85C0A42FD025F0E2B4CDB5CBABB7A4126F366F3D416BA7112092753F3315AAA43C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Local\Temp\8bfa\vlc.exe
Size 1021KB
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2324-48-0x0000022E497C0000-0x0000022E497C1000-memory.dmp

Download

memory/2324-49-0x00007FF92AE90000-0x00007FF92B159000-memory.dmp

Download

memory/2324-50-0x00007FF7BE9A0000-0x00007FF7BEAA3000-memory.dmp

Download