58cffa9bf72828287ec79a44d84d9624908e5d4b2484e40ed15e00adaaf4a940

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan_IMG00821800.hta
Size 1KB
Sample260910-ak3dtaed42
SHA256 58cffa9bf72828287ec79a44d84d9624908e5d4b2484e40ed15e00adaaf4a940
MD5 a0064fb6c8147077638de6c8aa089ca2
SHA1 58286d0cda3a8eaf12bc0eb9c39e775df743bf4a
SHA512 83a49afc9b8fa2e981277347c00feb5d430d176298fe212d89629302695b1d6147bf8b10360a2d9440f89b7548601bf0e05b75012bf6df9fdd04943b2948a781
TLSH
T1CB41AD13A904959833711BAB1997C20DF1DEB2E340629870765E843A0F717CFB4F857A
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3884	wscript.exe
11	3884	wscript.exe
13	3884	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3884	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2924	timeout.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3964	1836	mshta.exe	87
PID 3964 wrote to memory of 3884	3964	cmd.exe	89
PID 3964 wrote to memory of 2924	3964	cmd.exe	90

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Scan_IMG00821800.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Windows\Temp\madness.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\wscript.exe
    wscript //nologo "C:\Windows\Temp\mechanographist.vbs"
    3⤵
    - Badlisted process makes network request
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

madness.bat

Path C:\Windows\Temp\madness.bat
Size 637B
SHA256 dc8b5ab9059415210076ccf46306c46554bad845848085dffff85c05e0d65bf1
MD5 fa5c8eb3806d342555344f49a2d9e495
SHA1 066502804a71715d673074d3008ef79bd5243948
SHA512 099ed9deecc5fd4cd75190f270487b9165805668efb11107318a38a9d031ef1e3f692108f19d9f0b59699a591bc293a65e2cb54b9bf50bfd8e383a20bff70ee6
TLSH
T16BF0F91BE455D5C16B853C90CCFF060F39DF9292D325A994A0F9B0241C05BED72CC6C6
MD5 SHA1 SHA512 TLSH

Submit Download

mechanographist.vbs

Path C:\Windows\Temp\mechanographist.vbs
Size 328B
SHA256 6fda4ad04d9d7fb6ce5c73b771b315f1baa499cd77e69bd7d686d1bf452f74e8
MD5 4c010e4b68663e68ac0f7751d13d766b
SHA1 35f7270948903b7e1ab413700dfc1d9d6fa45136
SHA512 6b523f6296cd5504489951b1fb0c25c02a176d96277f9d5d981b86ff96689f34fec019158dc67075912abc9c92f63ca04156f83d05ec478d2256ef659c608092
TLSH
T154E07D3AD9F45BCAFB136A6168400F1D7C67C3A1700B46A5F0F0A44018660FDA21CBEB
MD5 SHA1 SHA512 TLSH