Overview

overview

8

Static

static

3

meccha-cam....4.exe

windows10-2004-x64

1

meccha-cam....4.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    155s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    meccha-camouflage-v1.6.0-beta.4.exe
  • Size 334.3MB
  • Sample260707-ft619aav2s
  • SHA256 e33053e351e2c2a0bfe9da421e1195ce5eb868aa9b359fe8a8edf3404e3847c6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 37 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.6.0-beta.4.exe
    "C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.6.0-beta.4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5588
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:928
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5884
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5796

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        startup-20260707-061718-5588.log
        • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.6.0-beta.4\diagnostics\startup-20260707-061718-5588.log
        • Size 1KB
        • SHA256 9ee665b86539afa853636a05028194463ef34b8ec8ce0197e68f4ab5a01d8e97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 595B
        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MecchaCamouflage.Controller.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\MecchaCamouflage.Controller.dll
        • Size 151KB
        • SHA256 a17b67fba8630dd9615863cc8a59c812c8b3fa899e494e17395f5a6840009503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MecchaCamouflage.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\MecchaCamouflage.Core.dll
        • Size 96KB
        • SHA256 d6381a9620cd62839590b4079ac9f52d9f8f626473fb2cef4a6e7866ba7c193f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.SystemEvents.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\Microsoft.Win32.SystemEvents.dll
        • Size 113KB
        • SHA256 4f128a65a31239ec084cc39d02a1a0e8cfca92a19032d282c071c09a9a41e4c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Collections.Concurrent.dll
        • Size 197KB
        • SHA256 0d1a713952d044f3f707a6d0b7b03bd64d410d4866d55cd0c172aea5c315387d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Immutable.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Collections.Immutable.dll
        • Size 925KB
        • SHA256 f1bf4d036baf22580ced0afcd1512d1582e9990edad9ad50e83a0a5870330a29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 79e04d080b8c3eb92bd75d3358939b2e0adf2cad2639654ccc3b9722dde2ba14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Collections.Specialized.dll
        • Size 101KB
        • SHA256 5393620f914b78e5b40caa4d04bc5340fe5af5d23e288f1400d531cc9708fd75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Collections.dll
        • Size 289KB
        • SHA256 e8a4b43005fff65121433b298659322410a69bc02bcf44b223f1ed282a3a0335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.EventBasedAsync.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.ComponentModel.EventBasedAsync.dll
        • Size 45KB
        • SHA256 cb3d56e9f47d93ef5d71d9e4c5fbaf66d36d360d652772c82461154785329247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 cd2ba2cd76736c694e681b16b637bd6438d8bbda85017097efe4f3434ceaea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.TypeConverter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.ComponentModel.TypeConverter.dll
        • Size 749KB
        • SHA256 2028ce8bddd7438ae07851921dba921c4bec2f2554038658aca4f9a58a24a16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.ComponentModel.dll
        • Size 29KB
        • SHA256 aa146801ec84f20bdd0ba2f9114d868b8dc5723b75c7052d73dc16482eef7d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Diagnostics.Process.dll
        • Size 321KB
        • SHA256 3e1e85eb09b1e7f23c5a26e40f725dfe95810e27b7d038fdfbf24664948de5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.StackTrace.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Diagnostics.StackTrace.dll
        • Size 41KB
        • SHA256 12fc06aa3e24fd2d68792d67fd0de4f33eea209851d626a3e6598ff71ef93e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Common.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Drawing.Common.dll
        • Size 901KB
        • SHA256 565c21208548ec4d366b9b4c74d142f20acf5ea1c99b8aacdb5e07d6078908c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Drawing.Primitives.dll
        • Size 129KB
        • SHA256 f3433ee65bd917f3a7053db0c82b279e497b20d21e7315c30ae0ea7db7988679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Pipelines.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.IO.Pipelines.dll
        • Size 185KB
        • SHA256 337f64b658e93192560bfb6f1a0debf152f02263c39aed68636181df48921086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.Parallel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Linq.Parallel.dll
        • Size 757KB
        • SHA256 9f3559634e8f812d6571b1e1cfe8199e7356b92c211d333f62d604395466c3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Linq.dll
        • Size 681KB
        • SHA256 2142f1e852b8edbf8dceddb575177295dde02c8a368e716f0ca0c902d42bfe03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Memory.dll
        • Size 157KB
        • SHA256 8a9eb705fe5a69e936e49f86b507cbcb8dd1d2889f925485b5cd412deaa8dc50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 dc1945de746f94987ec705a1f27d512abf72a41a1da37e414d1951e4e823037a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Private.Uri.dll
        • Size 249KB
        • SHA256 5eba7dfb1d8a639c918ea182a15bd35256a11f9853003d39e7ad757ae08d4fca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Windows.Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Private.Windows.Core.dll
        • Size 1.8MB
        • SHA256 901887bf2ef710a98611271877e9e81c6f393906e3360d1386e3f512c538d585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Windows.GdiPlus.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Private.Windows.GdiPlus.dll
        • Size 417KB
        • SHA256 5ff73fb9161809b831f7bdcf30526e3f88e248ad16d06e48c50c76b507e8b295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Reflection.Metadata.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Reflection.Metadata.dll
        • Size 1.1MB
        • SHA256 03bcaa6abdec4bb0194689e41fb9c8bd07e4eb098421bba60d19d2134691a265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 96370a9241de81b737f80a582a05baaf20a5d4746f3cbe5cbdb387ffc5094d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Security.Cryptography.dll
        • Size 2.4MB
        • SHA256 56e43c3e486d790c64eeac87a5537dd1510b97830c87f062bc14eabbe82f95be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encodings.Web.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Text.Encodings.Web.dll
        • Size 121KB
        • SHA256 a4807681c163b2e62dec0f0ff1b288ae2392fec51a995bb479b16c29760ed023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Text.Json.dll
        • Size 1.8MB
        • SHA256 1d2e6b506ace3fd86cc9a914040fe309788d8210beec7bf8cbfb62cf67d5772d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Tasks.Parallel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Threading.Tasks.Parallel.dll
        • Size 129KB
        • SHA256 d2d14c51694a018189e67ab4d1116982ba78e8d3418377d574713c2687194831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Threading.dll
        • Size 81KB
        • SHA256 89a81656b39f93950f4ab2882b7ea350892edd7b6074ad67179ecc73ca01a190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Windows.Forms.Primitives.dll
        • Size 3.5MB
        • SHA256 3fb4a95941e63ca12517a46a9c48448158028246173b1730b774ca9044e2bada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.4\XMIaRO_q6uez\System.Windows.Forms.dll
        • Size 13.1MB
        • SHA256 de94e4ca05769cc090fd7be09c5a3132327e26a91b34dbb02467433dec4a2184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/928-1096-0x0000000006B20000-0x00000000073D3000-memory.dmp
        Download

        memory/2872-1095-0x0000020AC7750000-0x0000020AC8003000-memory.dmp
        Download

        memory/5884-400-0x00000279940F0000-0x00000279941F0000-memory.dmp
        Download

        memory/5884-429-0x0000027994410000-0x0000027994430000-memory.dmp
        Download

        memory/5884-383-0x00000279801E0000-0x00000279802E0000-memory.dmp
        Download

        memory/5884-398-0x0000027983C90000-0x0000027983CB0000-memory.dmp
        Download

        memory/5884-415-0x0000027983D70000-0x0000027983D90000-memory.dmp
        Download