613d1d90bfd54e2a2653eae40d2da5c45800ba6a522bb640ba5ae9cd00fd7342

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
netpidorwork.vbs
Size 5KB
Sample261107-v68syafe39
SHA256 613d1d90bfd54e2a2653eae40d2da5c45800ba6a522bb640ba5ae9cd00fd7342
MD5 d0f3c99c868b29e876a43669f60a6f52
SHA1 b45ae3b927730c18bc795f79e3df3464b573e8f5
SHA512 9d0a3a00a02597c7ce8cbfc454f0e15ba46d7105ccdf85846b286109c36cd4231d374ea88b555af39df50bec18ef9e09a0428d22f44fa7e0c0ce6a7e8003b1ba
SSDEEP 96:X6GmH0AIzM3VMq4LwFfk7HzBvfLT7v4giratZMIYRXgv1s1wZkvclq8rM:sH0Lg60Fsjp376atZBYRXt1wYclq8rM
TLSH
T17EC1E70DBC185A24D032E5E5789A9D1CF12F53330EA65422BDACC534BB377E002B4AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3612	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4512	3612	WScript.exe	84
PID 4512 wrote to memory of 4896	4512	csc.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\netpidorwork.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /target:winexe /optimize+ /reference:System.Drawing.dll /reference:System.Windows.Forms.dll /out:"C:\Users\Admin\AppData\Local\Temp\errspam.exe" "C:\Users\Admin\AppData\Local\Temp\errspam_src.cs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F0A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA0052FDCC0A448A283105B98A2B08AA4.TMP"
    3⤵
    PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9F0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9F0A.tmp
Size 1KB
SHA256 da321c8edeb81029d4f529f6a695db974c3f25b696166da90c658856ef33f9a2
MD5 d398353980be845831f810b753c273ef
SHA1 432c466bfc221531b765ebd2019f20ad79fe679f
SHA512 923aa12031555a424d1020b694990c823e62962c9b63dafedf88c8df27e18ee5d9b8378c2cac2825ff112a803de5b6c6a9003dce82cadb25394ef49b969be624
TLSH
T12241250093D84B1EF272433124F75729A678BE959EAB575EB584122E2F12B80DD83672
MD5 SHA1 SHA512 TLSH

Submit Download

errspam.exe

Path C:\Users\Admin\AppData\Local\Temp\errspam.exe
Size 7KB
SHA256 d38f29639e4b9616a9579dbef40dbf57bbab62e7e9d1c08f2c8afe8aa912e658
MD5 5688911c1add4d7d7610ad6b688db891
SHA1 2920b0bcd886cfa8ea471ea3c24a907db98e1e7e
SHA512 94c69bc1524b4bbd4ce5c6d07b93e689021c9bbb6bad016e38bde5002e60a74cf64fa85bd91f00f2b451edf22119e742da99e3cc2e87572b9d55a8eb23837664
SSDEEP 96:oWIe6VTh+NPHzqkPDDRm5nwIa7xg7swfPLgxzpOzbxWzNt:Oe6VlcHbRGa7xQsAwpAw
TLSH
T1C8E1E813A7D98922E8BA07387DB347101772F654497BCF8F68D8522DEEB371019563B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA0052FDCC0A448A283105B98A2B08AA4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA0052FDCC0A448A283105B98A2B08AA4.TMP
Size 1KB
SHA256 8fc4096b6d8fe12e10eeca16454034187b317d4bb2a8ed5148f6be8781de0657
MD5 9a0b5e9ff70c3573a25a353ec2c7c1b8
SHA1 a05366fa493c54ecc3b7a4b00337ca06f668dafb
SHA512 f3ef852a39709270a5889a2c6648ccd3ec5ec80ebc7638b7eeddb13686f9d0ffdf9c4b40486e53dd19e63e71f858f242d3f24dd859b186ee35d660a473cd8f90
TLSH
T14521AB41A3E8421EF2B3477069F2C362A1ACBE568D7A43EC3488175F2F25950C5836B1
MD5 SHA1 SHA512 TLSH

Submit Download

errspam_src.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\errspam_src.cs
Size 3KB
SHA256 8550a4638bf73094201874731993e9428630d23cb51aebb612bbe95e1d8196a2
MD5 fb1f18c95c0c0f63df6b3ca60fb35ee8
SHA1 b939d789401ff1d695faab70d7233f22209e48c3
SHA512 0c979314d2b0e2c95d231b87eca6e21c85dc3854be107926e8247e988fcc0c95d9a8b8de231c025315253054de791a0345c6e8b3285b6d2b6dc9158f4bb9af52
TLSH
T1B871410C381BAB585331562A9E959E0CE73BA133D2E61922FD6D43208F394314379FAC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads