Analysis
- max time kernel
899s - max time network
437s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
meccha-camouflage.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
meccha-camouflage.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target meccha-camouflage.exe
- Size 1.1MB
- Sample260625-thd3zsc16w
- SHA256 0f273ec76d7de1448012ee0039318a6e4307e33ce40999a2a3976e9744970d88
- MD5 9147a78b2aadf8f975fd1ad9732d979f
- SHA1 eb540ea2b65bc582b55330043822102db737f40d
- SHA512 1a195df5a855a88533329aa6a418427d9165c8069ca6f296956e52b2889678b114fa510beff956941a76907300b59ec8ef9ea9251a92e5a69f98305a14295676
- SSDEEP 24576:VAoeD899wZPNbkFeJ88T9bwaeCoK7j/jlFewE3JwziLLnHUOX9D0:VAf8sJS8T9zFEZw2Ld94
- TLSH T116455C3AA78811BDE0B6C279CE475943E67634090371D9FF03D155A61E5BAE0EE3BB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe 1176 meccha-camouflage.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\meccha-camouflage.exe"C:\Users\Admin\AppData\Local\Temp\meccha-camouflage.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5512
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5588
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\MecchaCamouflage\runtime\events.jsonl
- Size 5KB
- SHA256 1271c3543183e6420a95668afd9870fcdbe13c5fa46b09e518c5092830e0a8d1
- MD5 4b8c14e92c3e711289d1f0e631d96f04
- SHA1 c7b95b88e13f32fdcab56ddf258054649d9b973e
- SHA512 4707cef58c60a00d3ed933c2ea2e87e8e9760dd0fa956fedbbd2ffc454718e6c132642ad02632061ee8acd05af3e0564ca583019a8ea0d5ad7b8a341e3ad8a56
- SSDEEP 96:XgahRZw3wYwnwBw4wowVw2wow0w6wewvwTw1wDowVw2yp:XgaPS
- TLSH T1A4B11C05433AEEFE07FC8AA6BE0BA60F67C8F1DF728A5C5169194D09CF259352635003
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MecchaCamouflage\runtime\last_status.json.tmp
- Size 288B
- SHA256 f150544aed7bbb4b3a42a8321c35242a6ae2887e18665123c25a8d7bffe2b089
- MD5 055e3c9e3534550ba5b4dad6dd6e6282
- SHA1 db73723c2504126b5998f2241d5b900865eea0d1
- SHA512 50f7f5bc051fb9a4aca509d09d29b319ab1adc51e24c84d04e4fd9a876189310f3dc8c8c04b4e5fa0732daf4fc55d32260bfb7fd3e1d09fdbaaf76add988e7aa
- TLSH T102D02B2C6B6C9E670ECC55147C77F543E3AA4DEEE1823D20C5474C94C60EA248CB2943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MecchaCamouflage\runtime\runtime.log
- Size 4KB
- SHA256 ff776833977671cd737f834639729afccc596c7044a6908c62e5b1e24632d805
- MD5 7c1dd5e5fc8aa45c96b2c07ad8884db8
- SHA1 b993d8dfae1769cad58afd0d9cc1830957d2b3c6
- SHA512 b2ada76e76b86f4e1fe6041cfac5fe6afac072964d5d779f4c52a7fae70cd0f470c7a38cbf73bbb0579579077c57fddfaa2d0bc68c44039069d37be779412606
- SSDEEP 24:Kak8Dv+l2o+q2EqK8NcR6YqUFhqUFLIqUF9bqUFvqUFsqUFEqUFLqUF2qUFoqUFm:KB8DC2ThEFcS9fFL
- TLSH T159A17119837E97EE97D99E61BE8B990B9FC8F1AF73820D703E138449DF588201935093
- MD5 SHA1 SHA512 SSDEEP TLSH