5f59c1b8a2d40442aba8016866c904c0100a5c60b877eae1ffad2dcb0c93eb2f

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spreadsheet -99d-.wsf
Size 27KB
Sample260908-plfc1afd55
SHA256 5f59c1b8a2d40442aba8016866c904c0100a5c60b877eae1ffad2dcb0c93eb2f
MD5 67de8a842fa275f0650aa4343b050342
SHA1 6b7c82680293c768e4608b0d3a24da93108449b2
SHA512 ec9c717820f52770c43c66ad38cc2cd5824c3cfcddba90713f093ca176f465507f17d098330a14c4633982e94fc90271c558175006ebb3e5a3fdd4a8b39d59a7
SSDEEP 384:JhAMjZFZlRtruobz/e3lxrgVytEOLNsQ8upm1fZ8qYkyH:IOZlRtr3P4KlOMd5Yks
TLSH
T1BBD2FF3796FFD9A74F135CD2AF088C927856C768C8E8517A31CDC39EE148199F284A39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3008	WScript.exe
8	3008	WScript.exe
9	3008	WScript.exe
10	3008	WScript.exe
11	3008	WScript.exe
12	3008	WScript.exe
13	3008	WScript.exe
14	3008	WScript.exe
15	3008	WScript.exe
16	3008	WScript.exe
17	3008	WScript.exe
18	3008	WScript.exe
19	3008	WScript.exe
20	3008	WScript.exe
21	3008	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3008	WScript.exe

Script User-Agent 11 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\spreadsheet -99d-.wsf"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5oJoNyMJK

Path C:\Users\Admin\AppData\Local\Temp\5oJoNyMJK
Size 2KB
SHA256 56084dd0e344a7a31899d18a209600c0a236d24c39d7daf8d8aedba538694c91
MD5 bc20cff2e4d395b5e56457f5471f7909
SHA1 75a8f3752bd011dc22a661ce152abb5889cd4f6f
SHA512 05aebfff84bb7d847e64685c07dfcb2db5a80656f857400bbd076d86286268c35ac175d86f153a21bd537e549d641f6eeb5e54f5578fd4381e29f5460b83b2a5
TLSH
T1D3519226024D840103322A8CB8A41E24E9BF6932CCE59DD0F1BFE57A6FC5694DC699E9
MD5 SHA1 SHA512 TLSH

Submit Download