Analysis
- user interaction
yes - max time kernel
899s - max time network
537s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
28/07/2026, 02:31
General
- Target uninstaller.txt
- Size 2KB
- Sample260728-cz4arsxtay
- SHA256 a377c28d49cead19187b308ab31afcc0f7a00a805ff1c6eed4782c8f34d4616e
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\uninstaller.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_eq5l5myw.qay.ps1
memory/3892-104-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-101-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-4-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-6-0x0000000005CE0000-0x0000000005D02000-memory.dmp
memory/3892-10-0x0000000006600000-0x0000000006666000-memory.dmp
memory/3892-9-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/3892-11-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-12-0x0000000006670000-0x00000000069CB000-memory.dmp
memory/3892-13-0x0000000006A90000-0x0000000006AAE000-memory.dmp
memory/3892-14-0x0000000006AF0000-0x0000000006B3C000-memory.dmp
memory/3892-15-0x0000000007CE0000-0x0000000007D16000-memory.dmp
memory/3892-18-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-21-0x00000000070D0000-0x00000000070F0000-memory.dmp
memory/3892-17-0x0000000070B70000-0x0000000070ECB000-memory.dmp
memory/3892-16-0x0000000070A10000-0x0000000070A5C000-memory.dmp
memory/3892-22-0x0000000007D60000-0x0000000007E03000-memory.dmp
memory/3892-23-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-25-0x0000000007EF0000-0x0000000007F0A000-memory.dmp
memory/3892-24-0x0000000008550000-0x0000000008BCC000-memory.dmp
memory/3892-27-0x00000000080E0000-0x00000000080FA000-memory.dmp
memory/3892-119-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-30-0x0000000008100000-0x0000000008106000-memory.dmp
memory/3892-32-0x0000000008140000-0x0000000008148000-memory.dmp
memory/3892-31-0x0000000008110000-0x000000000811A000-memory.dmp
memory/3892-29-0x00000000070D0000-0x00000000070D8000-memory.dmp
memory/3892-117-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-28-0x0000000008190000-0x00000000081BA000-memory.dmp
memory/3892-34-0x00000000081D0000-0x00000000081D8000-memory.dmp
memory/3892-116-0x0000000009420000-0x0000000009428000-memory.dmp
memory/3892-115-0x0000000009400000-0x000000000941C000-memory.dmp
memory/3892-114-0x00000000093B0000-0x00000000093C5000-memory.dmp
memory/3892-113-0x00000000092A0000-0x00000000092B0000-memory.dmp
memory/3892-112-0x0000000009050000-0x0000000009061000-memory.dmp
memory/3892-111-0x0000000009070000-0x0000000009106000-memory.dmp
memory/3892-107-0x0000000070B70000-0x0000000070ECB000-memory.dmp
memory/3892-3-0x00000000056F0000-0x0000000005726000-memory.dmp
memory/3892-110-0x0000000008500000-0x000000000850A000-memory.dmp
memory/3892-106-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-105-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/3892-2-0x0000000073FE2000-0x0000000073FE3000-memory.dmp
memory/3892-26-0x00000000082C0000-0x00000000084C4000-memory.dmp
memory/3892-5-0x0000000005F40000-0x000000000658A000-memory.dmp
memory/3892-33-0x00000000081F0000-0x0000000008216000-memory.dmp
memory/3892-103-0x0000000073FE2000-0x0000000073FE3000-memory.dmp
memory/3892-102-0x0000000073FD0000-0x000000007478C000-memory.dmp
memory/4856-99-0x000002813BB40000-0x000002813BB41000-memory.dmp
memory/4856-94-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-89-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-88-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-86-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-84-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-85-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-83-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-82-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-75-0x0000028139F50000-0x0000028139F51000-memory.dmp
memory/4856-74-0x0000028139F40000-0x0000028139F41000-memory.dmp
memory/4856-35-0x0000028129B80000-0x0000028129B90000-memory.dmp
memory/4856-100-0x000002813BB40000-0x000002813BB41000-memory.dmp
memory/4856-93-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-96-0x0000028139F80000-0x0000028139F81000-memory.dmp
memory/4856-90-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-77-0x0000028139F60000-0x0000028139F61000-memory.dmp
memory/4856-98-0x000002813A090000-0x000002813A091000-memory.dmp
memory/4856-97-0x0000028139F80000-0x0000028139F81000-memory.dmp
memory/4856-92-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-78-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-81-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-80-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-79-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-87-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-76-0x0000028139F50000-0x0000028139F51000-memory.dmp
memory/4856-51-0x0000028129C80000-0x0000028129C90000-memory.dmp
memory/4856-70-0x0000028126FD0000-0x0000028126FD1000-memory.dmp
memory/4856-72-0x0000028139F40000-0x0000028139F41000-memory.dmp
memory/4856-95-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-118-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-91-0x0000028139F70000-0x0000028139F71000-memory.dmp
memory/4856-121-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-123-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-124-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-133-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-134-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-182-0x0000028129410000-0x0000028129832000-memory.dmp
memory/4856-183-0x0000028129410000-0x0000028129832000-memory.dmp