20a3ffd263e58e0abc0deb0454dd9d59a59d9a7c643a70edd72c444223805437

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spreadsheet -d01-.wsf
Size 27KB
Sample260910-ajlpnssdpc
SHA256 20a3ffd263e58e0abc0deb0454dd9d59a59d9a7c643a70edd72c444223805437
MD5 6e12c3bab50b420817a5efe8fd425fcf
SHA1 327d40b30723d7e1c6df51479d38fd7ce2718d03
SHA512 de89d3844d0e1211828d2bb3cde94661031dad95aeae9240be3bb11d60c34f3150316d1787d4834279a8f33ffe8d39953c777302e14585339cb98411ea787fd3
SSDEEP 768:4QonsHhURgjtBkVWltyBzlgj46h01J+UR:ksHhURrHZy9Cz9
TLSH
T167D2FD3392FFCA9B4F026DE2BB01C8927C56C6689CFC613A318DC71DD194199F285A79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 16 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2820	WScript.exe
6	2820	WScript.exe
7	2820	WScript.exe
10	2820	WScript.exe
15	2820	WScript.exe
19	2820	WScript.exe
21	2820	WScript.exe
22	2820	WScript.exe
23	2820	WScript.exe
25	2820	WScript.exe
26	2820	WScript.exe
28	2820	WScript.exe
29	2820	WScript.exe
31	2820	WScript.exe
32	2820	WScript.exe
34	2820	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2820	WScript.exe

Script User-Agent 11 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	26	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\spreadsheet -d01-.wsf"
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kbE2cJjn

Path C:\Users\Admin\AppData\Local\Temp\kbE2cJjn
Size 3KB
SHA256 7936e17eea27e7c97bc10746f6d5c3fd16ff9a78d6c61ca21437261a5f182b51
MD5 f65c3438f82d6fe93db9df59bd9f25f0
SHA1 55c5b72bdcbb340d0254c833e4f72c20e7516ba6
SHA512 63bdacc3b016fec063c4ca5e85d8d7494a6db34172ef8ec3b42ebeb81a653c5571c9e4cff0142e34c82862e844451bf7a5ab35caab92b2fdfe30bc1d75639380
TLSH
T12E711132514A102F2643398BF5107B4EB8D7817DEFAB065455F86EEE37F2D10CB6A12A
MD5 SHA1 SHA512 TLSH

Submit Download