430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe
Size 2.5MB
Sample261011-e82veax15m
SHA256 430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383
MD5 9fb1845b1ae4ef6f3749b86cf7dc18c5
SHA1 326869aa58e70696281a266040e38d343e8538d5
SHA512 f1890b30a25a71606517900c3fe8078f32f0868314498faf16b4983e45e6a06bbd146ee9b8e184066c741c6743b554fcffe1b1b22c66333d032715934d22faa6
SSDEEP 49152:yeWyuOzclUKtvhib8aJwFJPMKSzTW84vslX2EZwqGLadx58c29G1rv:yeHuFUKtZHaikBB4KtZvdx5e9Yv
TLSH
T15FC533BEAF24DCB7F2213F7C08B55E3179E7291160A443470666722BF0D7A864A1E5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4292	WinCam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{7C469043-181A-47E2-B045-A23CA8DC0618}	WinCam.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	WinCam.exe
Token: SeCreatePagefilePrivilege	4292	WinCam.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4292	WinCam.exe
4292	WinCam.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4292	WinCam.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4292	WinCam.exe
4292	WinCam.exe
4292	WinCam.exe
4292	WinCam.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4292	2408	430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe	90

C:\Users\Admin\AppData\Local\Temp\430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe
"C:\Users\Admin\AppData\Local\Temp\430284db85d2f8e072b6a6803afb0f16a34652fe1022fb388233f9904621d383.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
  C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinCam.exe

Path C:\Users\Admin\AppData\Local\Temp\WinCam\WinCam.exe
Size 6.9MB
SHA256 9400e7e3c3d4a459d13d401822ebc35c254855f4e243b43d102779810ce5abc5
MD5 5f26fbc36d2f2c8ab6c382e26116daf0
SHA1 2a2b18de6d268ea6ad8aaa0820feb0ccb059072a
SHA512 e761b078ef0364920018a7d2062d8aa3799f241b182317015b19fc3edc55ecde83d9bb2045a22506a063ee7cb742fb72e836338fc08d8de3923ff2d2cdce458e
SSDEEP 98304:pJM7gKGx7jJlEGvYklGL14Uc4RN/HMDPMZlv/fFJghXIwcBABn:pwGPfYklSBc4RN/HMDPMrvVJqYwcU
TLSH
T155767D9662F840D4D076D03DCE47851BE676BC10073287EF11A6A76A6F736D20E3AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chinese (Simplified).xml

Path C:\Users\Admin\AppData\Local\Temp\WinCam\lang\Chinese (Simplified).xml
Size 36KB
SHA256 426cd80fb0c073ce4a00ed16989e483c115bef8c6dd1f3ecd7b19b6edf404d97
MD5 7040b177899c978d5cb74e72e80cbae0
SHA1 d6aff969cf32892264c30bd95451daf595debd10
SHA512 2ea6fcfe4c89d64ef3b80eba1ffcb669f2e9be4409762db282f4f285e5a80daa5b3811ffc894441bf53bff253b679a1763ae5a085f594c58bfe2912aa2f49627
SSDEEP 384:yWwt48p45XeQoh2b96bxV2FAOH2za1tWoKkU/PIUBKavcnhyru9l74bvGPddTw5p:yTt486OQohW96bOqOpZ+t
TLSH
T18FF2AA129CFCA53294A7628373C495A438B4B3C6D34A05DD755F2ED81BA2EB091B73EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b08e7bf37618147d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b08e7bf37618147d.customDestinations-ms
Size 1KB
SHA256 8c4a2934ceff96c9ab3cf6e814b96df9f6aab587b9f5636fd81713a0c4bc4699
MD5 a562da30668e4d4686ff0a862c98960e
SHA1 0d81463de102f8b825044175c9e2e1738aeec9db
SHA512 52959466b8ce35dacf7849fbf7b364c96e564d9352990943a248a4eeeb6a3d7413aa3662d06393456d6bd29aab85d8c781d7730428646359a14133da3eb1e2b0
TLSH
T1A0411F12A6CF6A57D3BB3AFA24FB931862FCF8185301160E4080A4114E30700AF0D727
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads