Resubmissions
22/07/2025, 03:00
250722-dhbd4aej8v1029/11/2022, 17:12
221129-vq84rscc2y1024/10/2022, 15:21
221024-srbhsahdf210Analysis
- max time kernel
151s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2022, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
xxx.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
xxx.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target xxx.exe
- Size 673KB
- Sample221024-srbhsahdf2
- SHA256 952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f
- MD5 2e8897ef38d4abe4861360a4b6e895d5
- SHA1 f668b1110d8a6b1a3f638fd8a6276a7a1efe18db
- SHA512 02d7fe9141b25c74fb4721fa5cba6030cae671ec159987e1e0c95eee65fd5185586b0101af63e36f788cf8b7fc7044018e059301b17e5e63e68564d31f3610b8
- SSDEEP 12288:fjVr5+jJNj0H5zPYXADL1vpQ/ywpll/nh:fjB5WJOH5DYXAlvMyUJn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\OptimizeRestart.raw => C:\Users\Admin\Pictures\OptimizeRestart.raw.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\StartConvert.tiff => C:\Users\Admin\Pictures\StartConvert.tiff.PLAY xxx.exe File renamed C:\Users\Admin\Pictures\SearchPop.tif => C:\Users\Admin\Pictures\SearchPop.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\OptimizeRestart.raw.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\ResetRevoke.png.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\StartConvert.tiff xxx.exe File renamed C:\Users\Admin\Pictures\ResetRevoke.png => C:\Users\Admin\Pictures\ResetRevoke.png.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\SearchPop.tif.PLAY xxx.exe File opened for modification C:\Users\Admin\Pictures\StartConvert.tiff.PLAY xxx.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Public\Pictures\desktop.ini xxx.exe File opened for modification C:\Program Files (x86)\desktop.ini xxx.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Documents\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Searches\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Videos\desktop.ini xxx.exe File opened for modification C:\Users\Public\Desktop\desktop.ini xxx.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.ini xxx.exe File opened for modification C:\Program Files\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini xxx.exe File opened for modification C:\Users\Public\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Music\desktop.ini xxx.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Links\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini xxx.exe File opened for modification C:\Users\Public\Libraries\desktop.ini xxx.exe File opened for modification C:\Users\Public\Music\desktop.ini xxx.exe File opened for modification C:\Users\Public\Videos\desktop.ini xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI xxx.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini xxx.exe File opened for modification C:\Users\Public\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini xxx.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini xxx.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: xxx.exe File opened (read-only) \??\O: xxx.exe File opened (read-only) \??\R: xxx.exe File opened (read-only) \??\T: xxx.exe File opened (read-only) \??\V: xxx.exe File opened (read-only) \??\W: xxx.exe File opened (read-only) \??\Y: xxx.exe File opened (read-only) \??\G: xxx.exe File opened (read-only) \??\H: xxx.exe File opened (read-only) \??\P: xxx.exe File opened (read-only) \??\M: xxx.exe File opened (read-only) \??\Q: xxx.exe File opened (read-only) \??\Z: xxx.exe File opened (read-only) \??\B: xxx.exe File opened (read-only) \??\E: xxx.exe File opened (read-only) \??\J: xxx.exe File opened (read-only) \??\K: xxx.exe File opened (read-only) \??\L: xxx.exe File opened (read-only) \??\N: xxx.exe File opened (read-only) \??\S: xxx.exe File opened (read-only) \??\X: xxx.exe File opened (read-only) \??\A: xxx.exe File opened (read-only) \??\F: xxx.exe File opened (read-only) \??\I: xxx.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-125.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.jpg.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-150.png xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-250.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sl.pak.PLAY xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-100_contrast-black.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-96.png xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-unplated.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-100.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-16_altform-unplated.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-100.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.png xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.PLAY xxx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\3px.png xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\lpcstrings.json xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-lightunplated.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\index.txt xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso0127.acl xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\ui-strings.js.PLAY xxx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-125.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x.cur xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png xxx.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1 xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.PLAY xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-80.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.winmd xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-125.png xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.PLAY xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-100.png xxx.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.strings.psd1 xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\ui-strings.js xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_zh_CN.jar.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js.PLAY xxx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg xxx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar xxx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML xxx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125.png xxx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-100.png xxx.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.ini
- Size 1KB
- SHA256 15c0a1baf61b3dd29a84b72233871a43dc2e1a7835689d7a8bfbf857ae7fb893
- MD5 cd178e708187de91ebcaf5c72f1d6ef9
- SHA1 15b28cdb4b7ad0af3d3870d3127613ce2160ea9d
- SHA512 6fe3408b83a1263fe42d2cc57de726806f6393461ef5a3b0e69c7047756c2a1ede25e94cf929a1fcf939b8a0471bb8cf2ef018763f137c81e82fbc872ff4fa9f
- MD5 SHA1 SHA512