Overview

overview

8

Static

static

3

meccha-cam....5.exe

windows10-2004-x64

7

meccha-cam....5.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    899s
  • max time network
    549s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 03:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    meccha-camouflage-v1.6.0-beta.5.exe
  • Size 52.8MB
  • Sample260712-d9vbaacx2n
  • SHA256 38386eeb09c6810ec49e0c63a1b71a1875d1f83d7c7c4e71ccc08bc3a8d0caa8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 38 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.6.0-beta.5.exe
    "C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.6.0-beta.5.exe"
    1⤵
    • Loads dropped DLL
    PID:4068
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:6084
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:244
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3412
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5912
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1916
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:300

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            startup-20260711-234338-4068.log
            • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.6.0-beta.5\diagnostics\startup-20260711-234338-4068.log
            • Size 1KB
            • SHA256 438eddeb1abd7af45b2ca493d7822c91674f1df7204de8055462c7f25b5d0b35
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MecchaCamouflage.Controller.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\MecchaCamouflage.Controller.dll
            • Size 162KB
            • SHA256 29cc6d32bd60530eb7e55e5cf67f3a00303e82571163e138f89edcf5cfe184dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MecchaCamouflage.Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\MecchaCamouflage.Core.dll
            • Size 91KB
            • SHA256 d05f5cd2d7a7cf4cb0de4ef97950c42471850cf3a716ec036c198088ed3f00c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Win32.Registry.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\Microsoft.Win32.Registry.dll
            • Size 113KB
            • SHA256 c3bc5123f63651c7b1faa11c313a03826895721b0934e1f2b3118ba7a70df5d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Win32.SystemEvents.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\Microsoft.Win32.SystemEvents.dll
            • Size 113KB
            • SHA256 4f128a65a31239ec084cc39d02a1a0e8cfca92a19032d282c071c09a9a41e4c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Concurrent.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Collections.Concurrent.dll
            • Size 197KB
            • SHA256 0d1a713952d044f3f707a6d0b7b03bd64d410d4866d55cd0c172aea5c315387d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Immutable.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Collections.Immutable.dll
            • Size 925KB
            • SHA256 f1bf4d036baf22580ced0afcd1512d1582e9990edad9ad50e83a0a5870330a29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.NonGeneric.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Collections.NonGeneric.dll
            • Size 101KB
            • SHA256 79e04d080b8c3eb92bd75d3358939b2e0adf2cad2639654ccc3b9722dde2ba14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Specialized.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Collections.Specialized.dll
            • Size 101KB
            • SHA256 5393620f914b78e5b40caa4d04bc5340fe5af5d23e288f1400d531cc9708fd75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Collections.dll
            • Size 289KB
            • SHA256 e8a4b43005fff65121433b298659322410a69bc02bcf44b223f1ed282a3a0335
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.EventBasedAsync.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.ComponentModel.EventBasedAsync.dll
            • Size 45KB
            • SHA256 cb3d56e9f47d93ef5d71d9e4c5fbaf66d36d360d652772c82461154785329247
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.ComponentModel.Primitives.dll
            • Size 77KB
            • SHA256 cd2ba2cd76736c694e681b16b637bd6438d8bbda85017097efe4f3434ceaea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.TypeConverter.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.ComponentModel.TypeConverter.dll
            • Size 749KB
            • SHA256 2028ce8bddd7438ae07851921dba921c4bec2f2554038658aca4f9a58a24a16d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.ComponentModel.dll
            • Size 29KB
            • SHA256 aa146801ec84f20bdd0ba2f9114d868b8dc5723b75c7052d73dc16482eef7d4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.StackTrace.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Diagnostics.StackTrace.dll
            • Size 41KB
            • SHA256 12fc06aa3e24fd2d68792d67fd0de4f33eea209851d626a3e6598ff71ef93e77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Drawing.Common.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Drawing.Common.dll
            • Size 901KB
            • SHA256 565c21208548ec4d366b9b4c74d142f20acf5ea1c99b8aacdb5e07d6078908c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Drawing.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Drawing.Primitives.dll
            • Size 129KB
            • SHA256 f3433ee65bd917f3a7053db0c82b279e497b20d21e7315c30ae0ea7db7988679
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.IO.Pipelines.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.IO.Pipelines.dll
            • Size 185KB
            • SHA256 337f64b658e93192560bfb6f1a0debf152f02263c39aed68636181df48921086
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.Parallel.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Linq.Parallel.dll
            • Size 757KB
            • SHA256 9f3559634e8f812d6571b1e1cfe8199e7356b92c211d333f62d604395466c3b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Linq.dll
            • Size 681KB
            • SHA256 2142f1e852b8edbf8dceddb575177295dde02c8a368e716f0ca0c902d42bfe03
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Memory.dll
            • Size 157KB
            • SHA256 8a9eb705fe5a69e936e49f86b507cbcb8dd1d2889f925485b5cd412deaa8dc50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.CoreLib.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Private.CoreLib.dll
            • Size 15.3MB
            • SHA256 dc1945de746f94987ec705a1f27d512abf72a41a1da37e414d1951e4e823037a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Uri.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Private.Uri.dll
            • Size 249KB
            • SHA256 5eba7dfb1d8a639c918ea182a15bd35256a11f9853003d39e7ad757ae08d4fca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Windows.Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Private.Windows.Core.dll
            • Size 1.8MB
            • SHA256 901887bf2ef710a98611271877e9e81c6f393906e3360d1386e3f512c538d585
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Windows.GdiPlus.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Private.Windows.GdiPlus.dll
            • Size 417KB
            • SHA256 5ff73fb9161809b831f7bdcf30526e3f88e248ad16d06e48c50c76b507e8b295
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Reflection.Metadata.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Reflection.Metadata.dll
            • Size 1.1MB
            • SHA256 03bcaa6abdec4bb0194689e41fb9c8bd07e4eb098421bba60d19d2134691a265
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Runtime.InteropServices.dll
            • Size 109KB
            • SHA256 96370a9241de81b737f80a582a05baaf20a5d4746f3cbe5cbdb387ffc5094d75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Security.Cryptography.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Security.Cryptography.dll
            • Size 2.4MB
            • SHA256 56e43c3e486d790c64eeac87a5537dd1510b97830c87f062bc14eabbe82f95be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encodings.Web.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Text.Encodings.Web.dll
            • Size 121KB
            • SHA256 a4807681c163b2e62dec0f0ff1b288ae2392fec51a995bb479b16c29760ed023
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Json.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Text.Json.dll
            • Size 1.8MB
            • SHA256 1d2e6b506ace3fd86cc9a914040fe309788d8210beec7bf8cbfb62cf67d5772d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.Tasks.Parallel.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Threading.Tasks.Parallel.dll
            • Size 129KB
            • SHA256 d2d14c51694a018189e67ab4d1116982ba78e8d3418377d574713c2687194831
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Threading.dll
            • Size 81KB
            • SHA256 89a81656b39f93950f4ab2882b7ea350892edd7b6074ad67179ecc73ca01a190
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Windows.Forms.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Windows.Forms.Primitives.dll
            • Size 3.5MB
            • SHA256 3fb4a95941e63ca12517a46a9c48448158028246173b1730b774ca9044e2bada
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Windows.Forms.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\System.Windows.Forms.dll
            • Size 13.1MB
            • SHA256 de94e4ca05769cc090fd7be09c5a3132327e26a91b34dbb02467433dec4a2184
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WebView2Loader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\WebView2Loader.dll
            • Size 159KB
            • SHA256 12f7708910e1aac5cc9ac43603d122f1d2e770ae2651830a07ef8b3117f28c55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            meccha-camouflage.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.6.0-beta.5\jFQHLMTko8W-\meccha-camouflage.dll
            • Size 9.2MB
            • SHA256 19017aed2b599f99d082ad40045e8b45c5549f3d1aa743d5bb7cee814cd10a54
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5912-446-0x00000252801E0000-0x00000252802E0000-memory.dmp
            Download

            memory/5912-444-0x00000252801E0000-0x00000252802E0000-memory.dmp
            Download

            memory/5912-490-0x0000025294200000-0x0000025294220000-memory.dmp
            Download

            memory/5912-456-0x0000025282E80000-0x0000025282F80000-memory.dmp
            Download

            memory/5912-471-0x0000025282C80000-0x0000025282CA0000-memory.dmp
            Download

            memory/5912-455-0x0000025282920000-0x0000025282940000-memory.dmp
            Download

            memory/5912-445-0x00000252801E0000-0x00000252802E0000-memory.dmp
            Download