Resubmissions
22/07/2025, 03:00
250722-dhbd4aej8v1029/11/2022, 17:12
221129-vq84rscc2y1024/10/2022, 15:21
221024-srbhsahdf210Analysis
- max time kernel
151s - max time network
51s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
24/10/2022, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
xxx.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
xxx.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target xxx.exe
- Size 673KB
- Sample221024-srbhsahdf2
- SHA256 952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f
- MD5 2e8897ef38d4abe4861360a4b6e895d5
- SHA1 f668b1110d8a6b1a3f638fd8a6276a7a1efe18db
- SHA512 02d7fe9141b25c74fb4721fa5cba6030cae671ec159987e1e0c95eee65fd5185586b0101af63e36f788cf8b7fc7044018e059301b17e5e63e68564d31f3610b8
- SSDEEP 12288:fjVr5+jJNj0H5zPYXADL1vpQ/ywpll/nh:fjB5WJOH5DYXAlvMyUJn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DebugAssert.crw => C:\Users\Admin\Pictures\DebugAssert.crw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\GetTest.raw => C:\Users\Admin\Pictures\GetTest.raw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\PopRestart.raw => C:\Users\Admin\Pictures\PopRestart.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\InitializeConvert.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\InvokeStep.raw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\ConfirmInstall.tif => C:\Users\Admin\Pictures\ConfirmInstall.tif.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\InvokeStep.raw => C:\Users\Admin\Pictures\InvokeStep.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\ConfirmInstall.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\DebugAssert.crw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\GetTest.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\PopRestart.raw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\InitializeConvert.tif => C:\Users\Admin\Pictures\InitializeConvert.tif.PLAY xxx.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Searches\desktop.ini xxx.exe File opened for modification C:\Users\Public\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini xxx.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini xxx.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini xxx.exe File opened for modification C:\Program Files (x86)\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI xxx.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini xxx.exe File opened for modification C:\Program Files\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Public\Desktop\desktop.ini xxx.exe File opened for modification C:\Users\Public\desktop.ini xxx.exe File opened for modification C:\Users\Public\Pictures\desktop.ini xxx.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini xxx.exe File opened for modification C:\Users\Public\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini xxx.exe File opened for modification C:\Users\Public\Videos\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Music\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Videos\desktop.ini xxx.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini xxx.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini xxx.exe File opened for modification C:\Users\Public\Libraries\desktop.ini xxx.exe File opened for modification C:\Users\Public\Music\desktop.ini xxx.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: xxx.exe File opened (read-only) \??\H: xxx.exe File opened (read-only) \??\N: xxx.exe File opened (read-only) \??\P: xxx.exe File opened (read-only) \??\T: xxx.exe File opened (read-only) \??\Y: xxx.exe File opened (read-only) \??\I: xxx.exe File opened (read-only) \??\K: xxx.exe File opened (read-only) \??\L: xxx.exe File opened (read-only) \??\M: xxx.exe File opened (read-only) \??\W: xxx.exe File opened (read-only) \??\X: xxx.exe File opened (read-only) \??\B: xxx.exe File opened (read-only) \??\E: xxx.exe File opened (read-only) \??\Q: xxx.exe File opened (read-only) \??\S: xxx.exe File opened (read-only) \??\U: xxx.exe File opened (read-only) \??\Z: xxx.exe File opened (read-only) \??\F: xxx.exe File opened (read-only) \??\G: xxx.exe File opened (read-only) \??\J: xxx.exe File opened (read-only) \??\O: xxx.exe File opened (read-only) \??\R: xxx.exe File opened (read-only) \??\V: xxx.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.PLAY xxx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo xxx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPQUOT.DPV.PLAY xxx.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02386_.WMF xxx.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21318_.GIF.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF.PLAY xxx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png xxx.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\THMBNAIL.PNG xxx.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDCNCLS.ICO.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.ELM xxx.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcer.dll.mui xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml xxx.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\cpu.js xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV xxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.PLAY xxx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BROCHURE.DPV.PLAY xxx.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6 xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF xxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188513.WMF xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN111.XML xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238927.WMF xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL.PLAY xxx.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21322_.GIF xxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css xxx.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0234266.WMF xxx.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHKEY.DAT.PLAY xxx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml xxx.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.PLAY xxx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui xxx.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png xxx.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\desktop.ini
- Size 1KB
- SHA256 1e57c983e8905f2a5fbbee56a8b1817c1cb5a9c69c5a004b81ef70acabf987b9
- MD5 e679930ace81cc236e0dec7f05b2b94d
- SHA1 6d0d4a7ec6740963d13ea22ba91d5f618e5ebaf7
- SHA512 fa3b4763963e084da1bc4885592c84f3bf01f16b9d463ff1e873870701fae383264f3066f36ebac80abce33ae49c4974e699ec1305be6ad33d1254d34698103a
- MD5 SHA1 SHA512