CCP7[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CCP7.exe
Size 5.3MB
Sample231011-hwkl5sha2z
SHA256 8abf3eba7aff1d0423c31485d9801c07f156ef6f132a4af8621436891a9797b7
MD5 fb2a33a4ae17196f8f42208bf12a733e
SHA1 5be80a5b74f72ea4e1f16409e31f799996e318d2
SHA512 8595998132bbce2eb1ec269d2fe71b498d6d3d941882906412f2f55761a827eea3c8b4b41deea04fe239db0276ff68a0e2f5e80cc74dc3170a305cdfaa4c1ca9
SSDEEP 49152:YaA97M6qivoA1W4xMGgObhSau0SK3yL4OneqxqhQDzH459BKQ1LriDTGtObnwV6p:m1/l1EyOnlzDyk5sV6WXNX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CCP7.exe

File Explorer

CCP7.exe

.exe 5.3MB

CCP7.exe

IMPHASH 80868b6f6d3204b2e3723eb9b06fe534
SHA256 8abf3eba7aff1d0423c31485d9801c07f156ef6f132a4af8621436891a9797b7
MD5 fb2a33a4ae17196f8f42208bf12a733e
SHA1 5be80a5b74f72ea4e1f16409e31f799996e318d2
SHA512 8595998132bbce2eb1ec269d2fe71b498d6d3d941882906412f2f55761a827eea3c8b4b41deea04fe239db0276ff68a0e2f5e80cc74dc3170a305cdfaa4c1ca9
SSDEEP 49152:YaA97M6qivoA1W4xMGgObhSau0SK3yL4OneqxqhQDzH459BKQ1LriDTGtObnwV6p:m1/l1EyOnlzDyk5sV6WXNX
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3383148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsDebuggerPresent SetConsoleScreenBufferSize CreateFileW GetLargestConsoleWindowSize SetConsoleWindowInfo GetConsoleScreenBufferInfo FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorPosition lstrlenW GetProcAddress SetConsoleMode GetModuleHandleA GetSystemInfo GetFileInformationByHandleEx GetConsoleMode GetStdHandle ReleaseMutex ReleaseSRWLockShared AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError RtlVirtualUnwind GetEnvironmentVariableW SetFilePointerEx SetConsoleTitleW GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry AcquireSRWLockShared WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA GetFileInformationByHandle CreateDirectoryW FindFirstFileW FindClose GetFinalPathNameByHandleW UnhandledExceptionFilter WaitForSingleObject SetUnhandledExceptionFilter SetHandleInformation GetModuleHandleW FormatMessageW GetFullPathNameW QueryPerformanceCounter MultiByteToWideChar WriteConsoleW WideCharToMultiByte ReadConsoleW CreateThread GetSystemTimeAsFileTime PostQueuedCompletionStatus QueryPerformanceFrequency InitializeSListHead GetCurrentThreadId AcquireSRWLockExclusive CreateIoCompletionPort CloseHandle SetFileCompletionNotificationModes GetLastError GlobalMemoryStatusEx Sleep GetCurrentDirectoryW GetQueuedCompletionStatusEx SwitchToThread ReleaseSRWLockExclusive TryAcquireSRWLockExclusive HeapReAlloc HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent

bcrypt

BCryptGenRandom

crypt32

CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain

ws2_32

WSASend WSAStartup recv shutdown connect WSAIoctl socket getsockname WSACleanup closesocket getpeername setsockopt bind ioctlsocket WSASocketW freeaddrinfo send WSAGetLastError getsockopt getaddrinfo

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

ntdll

NtReadFile NtCancelIoFileEx RtlNtStatusToDosError NtCreateFile NtWriteFile NtDeviceIoControlFile

secur32

InitializeSecurityContextW ApplyControlToken DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA DecryptMessage QueryContextAttributesW FreeContextBuffer AcceptSecurityContext EncryptMessage

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036

pdh

PdhCloseQuery PdhGetFormattedCounterArrayA PdhOpenQueryA PdhCollectQueryData PdhAddEnglishCounterA

vcruntime140

memcpy __current_exception_context __CxxFrameHandler3 memset memcmp memmove _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv _set_app_type terminate _seh_filter_exe exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free