80fe1e21ae1848a368171a7024ee4829628463ffc6c703b4b374644a5843f146

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virtual_cam_worker.pyc
Size 30KB
Sample260508-3wc8aafx2w
SHA256 80fe1e21ae1848a368171a7024ee4829628463ffc6c703b4b374644a5843f146
MD5 b36474cc55ff55852290e27f982c9cd6
SHA1 9f8fb80d8351f162cda8ed96767c30266745b4ef
SHA512 d87ab06872941897cdaa88289512186d87cce47a33c2758983f11f2147d82dc34b42119bc2c71a8f96484056983a76f9f1fe69fefd2245fa062e825c46fd53f5
SSDEEP 768:9fUuTOyxHvbZIaHgF1Rs2H9BM/62eK6XLkEOnU5aa:9cRyNdIaHgDRsAM/xG7kEe5a
TLSH
T101D24A8F72361D67FD52F6B6815B1780CA988F62532608E1301DD21D7FCA2D41E2F6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
960	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\virtual_cam_worker.pyc
1⤵
- Modifies registry class
PID:4412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-1-0x0000022314190000-0x000002231425D000-memory.dmp

Download

memory/4412-0-0x0000022E7C360000-0x0000022E7C42D000-memory.dmp