Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/07/2026, 18:03
General
- Target $R0/Uninstall Anytype.exe
- Size 148KB
- Sample260702-wnf6msgv8m
- SHA256 55dcf8997b5f5951d65b206cf70a350d2b792e4d610f66b83b9f91f3fc67dba0
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Anytype.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Anytype.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Temp\$R0', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0dduvc3x.ylv.ps1
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
Un_A.exe
memory/2240-41-0x00000000077B0000-0x0000000007854000-memory.dmp
memory/2240-45-0x0000000007C70000-0x0000000007C9A000-memory.dmp
memory/2240-26-0x00000000062B0000-0x0000000006607000-memory.dmp
memory/2240-27-0x00000000066F0000-0x000000000670E000-memory.dmp
memory/2240-28-0x0000000006720000-0x000000000676C000-memory.dmp
memory/2240-29-0x000000007F7C0000-0x000000007F7D0000-memory.dmp
memory/2240-30-0x0000000006CC0000-0x0000000006CF4000-memory.dmp
memory/2240-31-0x0000000070830000-0x000000007087C000-memory.dmp
memory/2240-32-0x0000000005640000-0x0000000005650000-memory.dmp
memory/2240-33-0x0000000005640000-0x0000000005650000-memory.dmp
memory/2240-40-0x0000000006D20000-0x0000000006D3E000-memory.dmp
memory/2240-18-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/2240-42-0x00000000080E0000-0x000000000875A000-memory.dmp
memory/2240-43-0x0000000007A60000-0x0000000007A7A000-memory.dmp
memory/2240-44-0x0000000007AE0000-0x0000000007AEA000-memory.dmp
memory/2240-19-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/2240-46-0x0000000007CA0000-0x0000000007CC4000-memory.dmp
memory/2240-47-0x0000000070990000-0x0000000070CE7000-memory.dmp
memory/2240-17-0x0000000005860000-0x0000000005882000-memory.dmp
memory/2240-13-0x0000000005640000-0x0000000005650000-memory.dmp
memory/2240-16-0x0000000005C80000-0x00000000062AA000-memory.dmp
memory/2240-14-0x0000000003230000-0x0000000003266000-memory.dmp
memory/2240-15-0x0000000005640000-0x0000000005650000-memory.dmp
memory/3300-86-0x0000000006160000-0x00000000064B7000-memory.dmp
memory/3300-88-0x0000000006C40000-0x0000000006C8C000-memory.dmp
memory/3300-96-0x00000000079A0000-0x0000000007A44000-memory.dmp
memory/3300-89-0x0000000070810000-0x000000007085C000-memory.dmp
memory/3300-97-0x0000000070970000-0x0000000070CC7000-memory.dmp
memory/5020-70-0x0000000007DD0000-0x0000000007DE1000-memory.dmp
memory/5020-69-0x0000000007E60000-0x0000000007EF6000-memory.dmp
memory/5020-62-0x0000000070830000-0x000000007087C000-memory.dmp
memory/5020-60-0x00000000062F0000-0x0000000006647000-memory.dmp