56655a9305acaa5472c9a2b326dad231f4638ea8375895e9a4303c17bb99bf13

Analysis

max time kernel
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ekstre.xls.vbs
Size 85KB
Sample260903-vqyb9sysb1
SHA256 56655a9305acaa5472c9a2b326dad231f4638ea8375895e9a4303c17bb99bf13
MD5 be69e9f797c30478785ed3364000b893
SHA1 d0f1e5ffbb914351d6f106d94a146e37be3ad101
SHA512 7e000a796cde2c1239a10d19347a28ee54acdeaeed3e04b58807fff3076fd33c44ae3ffd78b587a4640fc1933004d21b79042d44f19326356d29a0b5e210774f
SSDEEP 96:2AvdXcvCvBnQOG/yPIh5tT1Q81e81pqnF+1dXizhTP4CN1ssQ1azytda1cIFC5rh:lzJaY8Xo1YJqmb
TLSH
T1A08353EA3516A46A810F4554E73F9BE48E5B8EF860934997EF044F531606ABC3D3E3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2828	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ekstre.xls.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads