6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
Size 47KB
Sample260925-w16basw1ez
SHA256 6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5
MD5 c61066945310562c5aa17c35fe5b263b
SHA1 bfefc4fc4cb47ddc5f55bf8679de1170b1b295be
SHA512 52f6471b3dd8600db3bd782903ea3a0eeecc0f4f944c1186ebc873f56bb6c37ae7bc81f8c3b3b0ab5869d4e6d4b0280e734af06f8c0df93e964d5bc9cadbe02d
SSDEEP 768:wvGoMHttpejGbklUeeN0WluVukfKhoArm99NboGgfsS:dXKGbSUq8kY/G6
TLSH
T17E234B4B2B8984F3C1DE053474E91F3B4F7E953425A4A4E3CBB347D669B9693E43820A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	uycunili.exe

Loads dropped DLL 2 IoCs

pid	Process
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
4872	uycunili.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cusyxchu = "C:\\Windows\\uycunili.exe"	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oszcofri.dll	uycunili.exe
File created	C:\Windows\SysWOW64\oszcofri.dll	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uycunili.exe	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uycunili.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
4872	uycunili.exe
4872	uycunili.exe
4872	uycunili.exe
4872	uycunili.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
4872	uycunili.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 2348	5460	jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe	79
PID 4872 wrote to memory of 2348	4872	uycunili.exe	79

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2348
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5460

C:\Windows\uycunili.exe
C:\Windows\uycunili.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oszcofri.dll

Path C:\Windows\SysWOW64\oszcofri.dll
Size 40KB
SHA256 11b2a5dedd781bada447827140b5a34fca94ea0f06856b6c576aa835734f2ff5
MD5 0518fed64b41b31828c03f6cd5443365
SHA1 9cb1286bef6a2297bd9485c0ad40f9374f709162
SHA512 b600dd24588f2eb0cb6cf50182a095f6536f16b69e4e06a6323dbedf956a27c79273d554a4a67139b9f06a94deca83a9cc051db51bc31b3682d2bb4dce6817a2
SSDEEP 768:EGbklUeeN0WluVukfKhoArm99NboGgfsS:EGbSUq8kY/G6
TLSH
T109033A561B8985F7C29F4138B0E91F3A4E7F983438E46493CB7347D628796D3E93820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uycunili.exe

Path C:\Windows\uycunili.exe
Size 47KB
SHA256 6c8873e69e2339a48cae5010ed5a6c42893211b8083e8dcf48bd942d14db76d5
MD5 c61066945310562c5aa17c35fe5b263b
SHA1 bfefc4fc4cb47ddc5f55bf8679de1170b1b295be
SHA512 52f6471b3dd8600db3bd782903ea3a0eeecc0f4f944c1186ebc873f56bb6c37ae7bc81f8c3b3b0ab5869d4e6d4b0280e734af06f8c0df93e964d5bc9cadbe02d
SSDEEP 768:wvGoMHttpejGbklUeeN0WluVukfKhoArm99NboGgfsS:dXKGbSUq8kY/G6
TLSH
T17E234B4B2B8984F3C1DE053474E91F3B4F7E953425A4A4E3CBB347D669B9693E43820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2348-1-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/5460-6-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/5460-4-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download