20a3ffd263e58e0abc0deb0454dd9d59a59d9a7c643a70edd72c444223805437

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spreadsheet -d01-.wsf
Size 27KB
Sample260910-ajlpnssdpc
SHA256 20a3ffd263e58e0abc0deb0454dd9d59a59d9a7c643a70edd72c444223805437
MD5 6e12c3bab50b420817a5efe8fd425fcf
SHA1 327d40b30723d7e1c6df51479d38fd7ce2718d03
SHA512 de89d3844d0e1211828d2bb3cde94661031dad95aeae9240be3bb11d60c34f3150316d1787d4834279a8f33ffe8d39953c777302e14585339cb98411ea787fd3
SSDEEP 768:4QonsHhURgjtBkVWltyBzlgj46h01J+UR:ksHhURrHZy9Cz9
TLSH
T167D2FD3392FFCA9B4F026DE2BB01C8927C56C6689CFC613A318DC71DD194199F285A79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3108	WScript.exe
14	3108	WScript.exe
17	3108	WScript.exe
25	3108	WScript.exe
30	3108	WScript.exe
47	3108	WScript.exe
53	3108	WScript.exe
55	3108	WScript.exe
67	3108	WScript.exe
68	3108	WScript.exe
70	3108	WScript.exe
71	3108	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3108	WScript.exe

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	68	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	47	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	53	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	67	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\spreadsheet -d01-.wsf"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kbE2cJjn

Path C:\Users\Admin\AppData\Local\Temp\kbE2cJjn
Size 3KB
SHA256 7936e17eea27e7c97bc10746f6d5c3fd16ff9a78d6c61ca21437261a5f182b51
MD5 f65c3438f82d6fe93db9df59bd9f25f0
SHA1 55c5b72bdcbb340d0254c833e4f72c20e7516ba6
SHA512 63bdacc3b016fec063c4ca5e85d8d7494a6db34172ef8ec3b42ebeb81a653c5571c9e4cff0142e34c82862e844451bf7a5ab35caab92b2fdfe30bc1d75639380
TLSH
T12E711132514A102F2643398BF5107B4EB8D7817DEFAB065455F86EEE37F2D10CB6A12A
MD5 SHA1 SHA512 TLSH

Submit Download