Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
xxx.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
xxx.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
xxx.exe
-
Size
673KB
-
MD5
2e8897ef38d4abe4861360a4b6e895d5
-
SHA1
f668b1110d8a6b1a3f638fd8a6276a7a1efe18db
-
SHA256
952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f
-
SHA512
02d7fe9141b25c74fb4721fa5cba6030cae671ec159987e1e0c95eee65fd5185586b0101af63e36f788cf8b7fc7044018e059301b17e5e63e68564d31f3610b8
-
SSDEEP
12288:fjVr5+jJNj0H5zPYXADL1vpQ/ywpll/nh:fjB5WJOH5DYXAlvMyUJn
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MountClear.tiff xxx.exe File renamed C:\Users\Admin\Pictures\BackupSplit.tif => C:\Users\Admin\Pictures\BackupSplit.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\BackupSplit.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\JoinSave.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\MountClear.tiff.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\DisconnectEdit.tiff xxx.exe File renamed C:\Users\Admin\Pictures\DisconnectEdit.tiff => C:\Users\Admin\Pictures\DisconnectEdit.tiff.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\MountClear.tiff => C:\Users\Admin\Pictures\MountClear.tiff.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\JoinSave.raw => C:\Users\Admin\Pictures\JoinSave.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\CompleteEnable.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\DisconnectEdit.tiff.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\RenameUnlock.crw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\EditRequest.png => C:\Users\Admin\Pictures\EditRequest.png.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\GroupMeasure.crw => C:\Users\Admin\Pictures\GroupMeasure.crw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\RenameUnlock.crw => C:\Users\Admin\Pictures\RenameUnlock.crw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\CompleteEnable.raw => C:\Users\Admin\Pictures\CompleteEnable.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\EditRequest.png.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\GroupMeasure.crw.PLAY xxx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Public\Libraries\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Videos\desktop.ini xxx.exe File opened for modification C:\Users\Public\Pictures\desktop.ini xxx.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Searches\desktop.ini xxx.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini xxx.exe File opened for modification C:\Users\Public\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini xxx.exe File opened for modification C:\Users\Public\Music\desktop.ini xxx.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini xxx.exe File opened for modification C:\Program Files (x86)\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI xxx.exe File opened for modification C:\Program Files\desktop.ini xxx.exe File opened for modification C:\Users\Public\Desktop\desktop.ini xxx.exe File opened for modification C:\Users\Public\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Public\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Public\Videos\desktop.ini xxx.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Music\desktop.ini xxx.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: xxx.exe File opened (read-only) \??\N: xxx.exe File opened (read-only) \??\P: xxx.exe File opened (read-only) \??\Z: xxx.exe File opened (read-only) \??\B: xxx.exe File opened (read-only) \??\F: xxx.exe File opened (read-only) \??\G: xxx.exe File opened (read-only) \??\J: xxx.exe File opened (read-only) \??\O: xxx.exe File opened (read-only) \??\S: xxx.exe File opened (read-only) \??\V: xxx.exe File opened (read-only) \??\H: xxx.exe File opened (read-only) \??\L: xxx.exe File opened (read-only) \??\R: xxx.exe File opened (read-only) \??\T: xxx.exe File opened (read-only) \??\X: xxx.exe File opened (read-only) \??\Y: xxx.exe File opened (read-only) \??\A: xxx.exe File opened (read-only) \??\E: xxx.exe File opened (read-only) \??\I: xxx.exe File opened (read-only) \??\K: xxx.exe File opened (read-only) \??\Q: xxx.exe File opened (read-only) \??\U: xxx.exe File opened (read-only) \??\W: xxx.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll xxx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\MediumTile.scale-200_contrast-white.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\webviewCore.min.js xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-400.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail2x.png xxx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ja.properties.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-200.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-40_contrast-white.png xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-unplated_contrast-white.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxSignature.p7x xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.scale-200.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-48.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_light_environment.png xxx.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.PLAY xxx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\release xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-lightunplated.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\ui-strings.js xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.ELM.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_permission_ios.gif xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\ui-strings.js xxx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\classlist.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-down_32.svg.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css xxx.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\Example1.Diagnostics.Tests.ps1 xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.PLAY xxx.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD576c04e229eca38d92554473f02f69448
SHA13c14265f71c22f57c03edd160c747fbf20c59ff5
SHA256a8fb7212ed1897c36c1379af74fb3844e811705f57b6ae78ce006fada99ff8b4
SHA512c65c5b2158ce4abe9653c5cc1dd0fa7ddeca4c67407d9a6dc527ebab670274b458563547c2a2e61318ff6aa2604c0777800a1ad37e25bef570c6ef36c84822bd