Overview
overview
7Static
static
3PCC2-Insta...16.exe
windows10-2004-x64
7PCC2-Insta...16.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$_CLICK/winplan.exe
windows10-2004-x64
3$_CLICK/winplan.exe
windows11-ltsc_2024-x64
3SDL.dll
windows10-2004-x64
3SDL.dll
windows11-ltsc_2024-x64
3SDL_image.dll
windows10-2004-x64
3SDL_image.dll
windows11-ltsc_2024-x64
3c2dump.exe
windows10-2004-x64
3c2dump.exe
windows11-ltsc_2024-x64
3c2export.exe
windows10-2004-x64
3c2export.exe
windows11-ltsc_2024-x64
3c2mgrep.exe
windows10-2004-x64
3c2mgrep.exe
windows11-ltsc_2024-x64
3c2mkturn.exe
windows10-2004-x64
3c2mkturn.exe
windows11-ltsc_2024-x64
3c2plugin.exe
windows10-2004-x64
3c2plugin.exe
windows11-ltsc_2024-x64
3c2pluginw.exe
windows10-2004-x64
3c2pluginw.exe
windows11-ltsc_2024-x64
3c2sweep.exe
windows10-2004-x64
3c2sweep.exe
windows11-ltsc_2024-x64
3c2unpack.exe
windows10-2004-x64
3c2unpack.exe
windows11-ltsc_2024-x64
3doc/AUTHORS.doc
windows10-2004-x64
1doc/AUTHORS.doc
windows11-ltsc_2024-x64
1doc/COPYING.doc
windows10-2004-x64
1doc/COPYING.doc
windows11-ltsc_2024-x64
1doc/NEWS.doc
windows10-2004-x64
1doc/NEWS.doc
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 12:20
Behavioral task
behavioral1
Sample
PCC2-Installer-2.0.16.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
PCC2-Installer-2.0.16.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$_CLICK/winplan.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$_CLICK/winplan.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
SDL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SDL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
SDL_image.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SDL_image.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
c2dump.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
c2dump.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
c2export.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
c2export.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
c2mgrep.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
c2mgrep.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
c2mkturn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
c2mkturn.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
c2plugin.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
c2plugin.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
c2pluginw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
c2pluginw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
c2sweep.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
c2sweep.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
c2unpack.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
c2unpack.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
doc/AUTHORS.doc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
doc/AUTHORS.doc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
doc/COPYING.doc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
doc/COPYING.doc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
doc/NEWS.doc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
doc/NEWS.doc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target PCC2-Installer-2.0.16.exe
- Size 3.6MB
- Sample260801-ph5hqaae37
- SHA256 7848f6a7270cdf736177541fcad627136fb09f5713402f1d0e250e02e716c3be
- MD5 5fb4baf34ea4c78283fa482e42dd04d5
- SHA1 d2287e1bf0894126dfb41911ffb6d06ab5ac7f6a
- SHA512 f94da834ac735d7f4b9cdc1a57cea252ef14106350131340f6564cf29ab7e75f3a80352316ddc384656a0ba93cc3fd9101a81ad01ae5554b18cb354a2a393350
- SSDEEP 98304:zwo2AihSpoOisYWFb1GprLVbt/KhNPRbTka4YSJe7WLWt:z59USpoShluLVNKZ4zoKq
- TLSH T1760633C664FD6797C4E74A701B374083CA6EE8C20CA7188F7616D59CAF60EA3D51C1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4216 PCC2-Installer-2.0.16.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\PCC2\specs\storm.nm PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\font4.fnt PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\advcloak.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\doubletorpcharge.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\b32\anticloakimmunity.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\playvcr.exe PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\c2unpack.exe PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\radio2.gfx PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\anticloak.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\specs\beamspec.dat PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\specs\msgparse.ini PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\launcher2.cd PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\bioscan.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\b32\level2tow.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\orecondenser.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\r32\ionshield.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\buildfighters.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\es.lang PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\beam1.cd PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\vcr\ftr8.gfx PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\bioscan.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\de.lang PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\advcloak.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\b32\imperialassault.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\cloakedbays.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\fullweaponry.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\scansallwormholes.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\specs\hostver.ini PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\refinery.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\doc\NEWS.doc PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\ionshield.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\rga.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\r32\selfrepair.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\specs\hullspec.dat PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\base\defense.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\planet\defense.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\vcr\ftr3.gfx PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\ramscoop.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\b32\rga.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\heglorydevice.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\base\newbase.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\vcr\ftr11.gfx PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\fullbioscan.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\32\pillage.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\b32\chunneltarget.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\hiss.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\r32\alchemy.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\32\darksense.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\32\heatsto50.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\beam1.cd PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\launcher6.cd PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\vcr\ftr11.gfx PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\selfrepair.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\c2unpack.exe PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\cbi.cd PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\advrefinery.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\32\buildfighters.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\beam2.cd PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\font4.fnt PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\index.txt PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\base\defense.png PCC2-Installer-2.0.16.exe File created C:\Program Files (x86)\PCC2\resource\abilities\b32\lizarddamagelimit.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\resource\abilities\r32\gambling.png PCC2-Installer-2.0.16.exe File opened for modification C:\Program Files (x86)\PCC2\specs\beamspec.dat PCC2-Installer-2.0.16.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCC2-Installer-2.0.16.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\shell\open PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\shell PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.c2z PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\shell\open\command PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ccb PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ccb\ = "PCC2.Simulation" PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation\shell\open\command PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation\shell PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation\shell\open PCC2-Installer-2.0.16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.c2p PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\ = "PCC2 Plugin" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\shell\open\ = "&Install" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation\ = "PlayVCR Saved Simulation Setup" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Simulation\shell\open\command\ = "\"C:\\Program Files (x86)\\PCC2\\playvcr.exe\" %1" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.c2z\ = "PCC2.Plugin" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.c2p\ = "PCC2.Plugin" PCC2-Installer-2.0.16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCC2.Plugin\shell\open\command\ = "\"C:\\Program Files (x86)\\PCC2\\c2pluginw.exe\" \"%1\"" PCC2-Installer-2.0.16.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nslDCEB.tmp\System.dll
- Size 10KB
- SHA256 af15ef6479e5ac5752d139d1c477ec02def9077df897dadc8297005b3fc4999d
- MD5 61151aff8c92ca17b3fab51ce1ca7156
- SHA1 68a02015863c2877a20c27da45704028dbaa7eff
- SHA512 4f5c943b7058910dc635bdcfadfea1d369c3d645239d1a52b030c21f43aac8e76549e52fd28e38ba5341d32aefe3c090dd8377d9e105ad77f71ab8870d8e326e
- SSDEEP 192:2OShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZaX5:n6OAOkWWycGP4XRwc2qFaX5
- TLSH T10F225C5502A442F3DC54923C08973D676F787A249EB48FC3CF931445AF299AABC7D326
- MD5 SHA1 SHA512 SSDEEP TLSH