8482a550799d0dedfd96f3808cd5164cfc8edfdf3380faf2eecf8a9faf2ba72f

Analysis

user interaction
yes
max time kernel
1s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UCR6v1.0_[unknowncheats.me]_.exe
Size 90KB
Sample260718-bmdnxaft5t
SHA256 8482a550799d0dedfd96f3808cd5164cfc8edfdf3380faf2eecf8a9faf2ba72f
MD5 e0dc721de4f172d2bcf9e78f6a33c6af
SHA1 924cc41777c98a61f992fd32fd984af12f23da2e
SHA512 27fd8de6c1b8875d7da5e1f4b4851e8fc7e8d23ba919e6eff2df8eee197f46226cfbe607335d73cb2989f44e5365f4c673d651bbde5f584d5e6a538dd4c8e2d2
SSDEEP 1536:p8+AG1B0Zod+CT1V1nzRzLd40CjVxWc6P5+ONOa34:XjBb+CT1V1nzRzJZC5xWNkilo
TLSH
T15B93F98FA67240E1C5FAD038A892221AFF717C954334A7CF9751A65B0F61BE46C3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3196	Uqrjs.sys

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Uqrjs.sys	UCR6v1.0_[unknowncheats.me]_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4432	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	UCR6v1.0_[unknowncheats.me]_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4432	5032	UCR6v1.0_[unknowncheats.me]_.exe	90

C:\Users\Admin\AppData\Local\Temp\UCR6v1.0_[unknowncheats.me]_.exe
"C:\Users\Admin\AppData\Local\Temp\UCR6v1.0_[unknowncheats.me]_.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:4432

C:\Windows\Uqrjs.sys
C:\Windows\Uqrjs.sys
1⤵
- Executes dropped EXE
PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uqrjs.sys

Path C:\Windows\Uqrjs.sys
Size 14KB
SHA256 5a14ef4f9eaaddbca1906048bf4be867675a8044fe7348bfba22f5bf299e55ef
MD5 3303c32983a85646c36cc6e5ac5274c4
SHA1 a330365baca9b96082b070c2480e270698986ef4
SHA512 51cc6272ca29b4865129a0c21452ecb16db2d1746d57668661318c38aac7805811314c68681242d2d2fdc2abcd942e965f42c5ec62fc9f915869b69aa019f1a6
SSDEEP 192:WxJXXiXRBfOM7qFy66/L/z78z57qFy66/L/z78ePbJ:W7niXR15eOX8teOX8ePt
TLSH
T1E3624ADB87141812ED92EE7292CEE926ADF976C0074565D70236C5D41CC77F02A3E6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download