430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe
Size 2.5MB
Sample261011-e82veax15m
SHA256 430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383
MD5 9fb1845b1ae4ef6f3749b86cf7dc18c5
SHA1 326869aa58e70696281a266040e38d343e8538d5
SHA512 f1890b30a25a71606517900c3fe8078f32f0868314498faf16b4983e45e6a06bbd146ee9b8e184066c741c6743b554fcffe1b1b22c66333d032715934d22faa6
SSDEEP 49152:yeWyuOzclUKtvhib8aJwFJPMKSzTW84vslX2EZwqGLadx58c29G1rv:yeHuFUKtZHaikBB4KtZvdx5e9Yv
TLSH
T15FC533BEAF24DCB7F2213F7C08B55E3179E7291160A443470666722BF0D7A864A1E5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WinCam.exe

Executes dropped EXE 1 IoCs

pid	Process
4696	WinCam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{5E3BABC0-ADF0-4F44-B7A7-A0E159B4F07E}	WinCam.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4696	WinCam.exe
Token: SeCreatePagefilePrivilege	4696	WinCam.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4696	WinCam.exe
4696	WinCam.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4696	WinCam.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4696	WinCam.exe
4696	WinCam.exe
4696	WinCam.exe
4696	WinCam.exe
4696	WinCam.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4696	2408	430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe	86

C:\Users\Admin\AppData\Local\Temp\430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe
"C:\Users\Admin\AppData\Local\Temp\430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
  C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinCam.exe

Path C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
Size 6.9MB
SHA256 9400e7e3c3d4a459d13d401822ebc35c254855f4e243b43d102779810ce5abc5
MD5 5f26fbc36d2f2c8ab6c382e26116daf0
SHA1 2a2b18de6d268ea6ad8aaa0820feb0ccb059072a
SHA512 e761b078ef0364920018a7d2062d8aa3799f241b182317015b19fc3edc55ecde83d9bb2045a22506a063ee7cb742fb72e836338fc08d8de3923ff2d2cdce458e
SSDEEP 98304:pJM7gKGx7jJlEGvYklGL14Uc4RN/HMDPMZlv/fFJghXIwcBABn:pwGPfYklSBc4RN/HMDPMrvVJqYwcU
TLSH
T155767D9662F840D4D076D03DCE47851BE676BC10073287EF11A6A76A6F736D20E3AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chinese (Simplified).xml

Path C:\Users\Admin\AppData\Local\Temp\WinCam\lang\Chinese (Simplified).xml
Size 36KB
SHA256 426cd80fb0c073ce4a00ed16989e483c115bef8c6dd1f3ecd7b19b6edf404d97
MD5 7040b177899c978d5cb74e72e80cbae0
SHA1 d6aff969cf32892264c30bd95451daf595debd10
SHA512 2ea6fcfe4c89d64ef3b80eba1ffcb669f2e9be4409762db282f4f285e5a80daa5b3811ffc894441bf53bff253b679a1763ae5a085f594c58bfe2912aa2f49627
SSDEEP 384:yWwt48p45XeQoh2b96bxV2FAOH2za1tWoKkU/PIUBKavcnhyru9l74bvGPddTw5p:yTt486OQohW96bOqOpZ+t
TLSH
T18FF2AA129CFCA53294A7628373C495A438B4B3C6D34A05DD755F2ED81BA2EB091B73EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b08e7bf37618147d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b08e7bf37618147d.customDestinations-ms
Size 1KB
SHA256 b38ba20f3004e43e44366afdc85730016bc83f3b97d7ac4add5c879691c31ad0
MD5 40c7ba81e0599a39498b4a0a2f53f03c
SHA1 70f72c1b5c8396af88345492371f8ab4c33016fa
SHA512 a6561e02b8727c81b32f15732b4fe923a5184d7378d7a60765869962774056202a2ae5f69703200b1d6e27ab4d41d26e6ef6889adc09c4d87a408a59dea155af
TLSH
T1C541CC51DBCF4997C3A77DBA68BAA70092F9F828A705AA49814062041E31640AF4E377
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads