Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 09:12
General
- Target Green Riyadh Uraija-PR.vbs
- Size 217KB
- Sample260421-k56bbaby9m
- SHA256 9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Green Riyadh Uraija-PR.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -NOP -nonI -EP BYPAss -Command "iex $env:7Qnw9QqsFYNhx3R"2⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe3⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Update Service" dir=out action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Update Service Host" dir=in action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_pmfz141i.tvt.ps1
rsql_2292_240671203.tmp
rsql_2292_240671203.tmp
wifi_profiles.tmp
memory/2292-83-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-43-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-53-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-57-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-59-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-61-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-63-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-65-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-55-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-21-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-25-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-26-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-24-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-23-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-22-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-66-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-68-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-70-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-35-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-36-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-39-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-38-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-40-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-41-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-42-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-58-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-44-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-46-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-45-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-71-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-50-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-49-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-51-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-54-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-73-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-60-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-74-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-56-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-62-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-64-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-67-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-69-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-72-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-76-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-80-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-85-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-89-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-88-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-87-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-86-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-84-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-75-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-77-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-78-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-82-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-81-0x0000000140000000-0x0000000140576000-memory.dmp
memory/2292-79-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4676-34-0x0000029D2CF10000-0x0000029D2CF1C000-memory.dmp
memory/4676-15-0x0000029D2CF10000-0x0000029D2CF1C000-memory.dmp
memory/4676-14-0x0000029D2CE10000-0x0000029D2CEBC000-memory.dmp
memory/5004-32-0x0000025176C80000-0x0000025176C8C000-memory.dmp
memory/5004-18-0x0000025177050000-0x0000025177060000-memory.dmp
memory/5004-0-0x0000025177050000-0x0000025177060000-memory.dmp
memory/5004-10-0x0000025176FC0000-0x0000025177002000-memory.dmp
memory/5004-31-0x0000025174CA0000-0x0000025174D4C000-memory.dmp
memory/5004-11-0x0000025176F80000-0x0000025176F8E000-memory.dmp
memory/5004-16-0x0000025174CA0000-0x0000025174D4C000-memory.dmp
memory/5004-17-0x0000025176C80000-0x0000025176C8C000-memory.dmp
memory/5004-7-0x0000025176F10000-0x0000025176F32000-memory.dmp
memory/5004-1-0x0000025177050000-0x0000025177060000-memory.dmp
memory/5004-13-0x0000025177050000-0x0000025177060000-memory.dmp
memory/5004-12-0x0000025177050000-0x0000025177060000-memory.dmp