Analysis
- max time kernel
158s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
04/11/2022, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
ccv.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ccv.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ccv.exe
- Size 224KB
- Sample221104-j5gsaaddf8
- SHA256 7bbfff4ecb5beaf20c8204be267776270daefb6eb0197c76649182350772162c
- MD5 d9b46196ec37fbc6acc3bd81442311bf
- SHA1 4ad109947b469ebe71f0f73c2acadcb4ba84be43
- SHA512 3cca8a67a301132b31ad79ffe225d678a9d1837b02a845813a1feb621d3bb5bbe64f9ec4d99345df314450c575858291e49db5f2de73dcf2064167f45d338659
- SSDEEP 6144:+pSnrXZU82f3e0UbqwOR0ORGIQf5EtoKs:hrpUFfXUmwqQZ5EtoN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CompareUndo.tiff ccv.exe File renamed C:\Users\Admin\Pictures\CompareUndo.tiff => C:\Users\Admin\Pictures\CompareUndo.tiff.PLAY ccv.exe File renamed C:\Users\Admin\Pictures\WriteResolve.tif => C:\Users\Admin\Pictures\WriteResolve.tif.PLAY ccv.exe File opened for modification C:\Users\Admin\Pictures\CompareUndo.tiff.PLAY ccv.exe File opened for modification C:\Users\Admin\Pictures\WriteResolve.tif.PLAY ccv.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ccv.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ccv.exe File opened for modification C:\Users\Public\Music\desktop.ini ccv.exe File opened for modification C:\Users\Public\Videos\desktop.ini ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ccv.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini ccv.exe File opened for modification C:\Users\Public\desktop.ini ccv.exe File opened for modification C:\Users\Public\Documents\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ccv.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ccv.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ccv.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ccv.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini ccv.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ccv.exe File opened for modification C:\Program Files (x86)\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Music\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ccv.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Links\desktop.ini ccv.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ccv.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ccv.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: ccv.exe File opened (read-only) \??\V: ccv.exe File opened (read-only) \??\W: ccv.exe File opened (read-only) \??\A: ccv.exe File opened (read-only) \??\G: ccv.exe File opened (read-only) \??\L: ccv.exe File opened (read-only) \??\M: ccv.exe File opened (read-only) \??\O: ccv.exe File opened (read-only) \??\R: ccv.exe File opened (read-only) \??\S: ccv.exe File opened (read-only) \??\X: ccv.exe File opened (read-only) \??\B: ccv.exe File opened (read-only) \??\E: ccv.exe File opened (read-only) \??\F: ccv.exe File opened (read-only) \??\H: ccv.exe File opened (read-only) \??\J: ccv.exe File opened (read-only) \??\K: ccv.exe File opened (read-only) \??\N: ccv.exe File opened (read-only) \??\Z: ccv.exe File opened (read-only) \??\I: ccv.exe File opened (read-only) \??\P: ccv.exe File opened (read-only) \??\T: ccv.exe File opened (read-only) \??\U: ccv.exe File opened (read-only) \??\Y: ccv.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.PLAY ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.PLAY ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.PLAY ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.PLAY ccv.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.PLAY ccv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-100.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-400.png ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_pdf_18.svg.PLAY ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-40_contrast-white.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png ccv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-300.png ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\ruleset_en-GB_TTS.lua ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\7.rsrc ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.PLAY ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl ccv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-125.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml ccv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-200.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe806.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp2.scale-200.png ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.PLAY ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.jpg ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Tongue.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\27.jpg ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.PLAY ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlInnerCircle.png ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.PLAY ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js.PLAY ccv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\packages.config ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-72_contrast-black.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-32_contrast-black.png ccv.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png ccv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml ccv.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-125_contrast-white.png ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js.PLAY ccv.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoCanary.png.PLAY ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.PLAY ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.PLAY ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\MessagesXboxLogo.png ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg ccv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.PLAY ccv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js.PLAY ccv.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bn.pak ccv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML ccv.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png ccv.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini
- Size 1KB
- SHA256 22781bd73269606c6f8ec1374a2b55b5f9dd46e992054e31bb6aab65ce860998
- MD5 dcc590fd2e1891a8e0894667c0a904b7
- SHA1 475166081c71f24e1ab8f3b731cf35f657059a8e
- SHA512 9d6bfa4b65f77a6e2f4541c62d193508e84f83432f1ba3d0d1717d454ba9b7fe2002c3a71ead94304bdc7285894f428017ddcaaeaff2183562d413bd9a99ddd9
- MD5 SHA1 SHA512