play | 757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280

General

Target

SD.exe
Size

501KB
MD5

6ea4b9b0ad0692892f6e4f1b4f05aa72
SHA1

3bb50ceeaa8a698687863dd44e149214d4372601
SHA256

757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280
SHA512

f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48
SSDEEP

6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN

Score

10^/10

play ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Modifies extensions of user files 24 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RegisterBlock.tiff	SD.exe
File renamed	C:\Users\Admin\Pictures\PopSearch.tif => C:\Users\Admin\Pictures\PopSearch.tif.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\TestStart.crw => C:\Users\Admin\Pictures\TestStart.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\GroupSuspend.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\RegisterBlock.tiff.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\TestStart.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\ExitSelect.crw => C:\Users\Admin\Pictures\ExitSelect.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\JoinOut.tiff => C:\Users\Admin\Pictures\JoinOut.tiff.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\ExpandInstall.raw => C:\Users\Admin\Pictures\ExpandInstall.raw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\AddMove.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\JoinHide.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\JoinHide.crw => C:\Users\Admin\Pictures\JoinHide.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\RegisterBlock.tiff => C:\Users\Admin\Pictures\RegisterBlock.tiff.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\SplitReset.raw => C:\Users\Admin\Pictures\SplitReset.raw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\HideInitialize.png.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\JoinOut.tiff.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\PopSearch.tif.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\SplitReset.raw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\AddMove.crw => C:\Users\Admin\Pictures\AddMove.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\JoinOut.tiff	SD.exe
File renamed	C:\Users\Admin\Pictures\GroupSuspend.crw => C:\Users\Admin\Pictures\GroupSuspend.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\HideInitialize.png => C:\Users\Admin\Pictures\HideInitialize.png.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\ExitSelect.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandInstall.raw.PLAY	SD.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 39 IoCs

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Users\Public\Downloads\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	SD.exe
File opened for modification	C:\Program Files\desktop.ini	SD.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	SD.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	SD.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	SD.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	SD.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SD.exe

description	ioc	process
File opened (read-only)	\??\E:	SD.exe
File opened (read-only)	\??\F:	SD.exe
File opened (read-only)	\??\J:	SD.exe
File opened (read-only)	\??\K:	SD.exe
File opened (read-only)	\??\L:	SD.exe
File opened (read-only)	\??\O:	SD.exe
File opened (read-only)	\??\T:	SD.exe
File opened (read-only)	\??\A:	SD.exe
File opened (read-only)	\??\G:	SD.exe
File opened (read-only)	\??\H:	SD.exe
File opened (read-only)	\??\I:	SD.exe
File opened (read-only)	\??\M:	SD.exe
File opened (read-only)	\??\V:	SD.exe
File opened (read-only)	\??\B:	SD.exe
File opened (read-only)	\??\S:	SD.exe
File opened (read-only)	\??\Y:	SD.exe
File opened (read-only)	\??\Z:	SD.exe
File opened (read-only)	\??\P:	SD.exe
File opened (read-only)	\??\Q:	SD.exe
File opened (read-only)	\??\R:	SD.exe
File opened (read-only)	\??\U:	SD.exe
File opened (read-only)	\??\W:	SD.exe
File opened (read-only)	\??\X:	SD.exe
File opened (read-only)	\??\N:	SD.exe

Drops file in Program Files directory 64 IoCs

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3F.GIF.PLAY	SD.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02793_.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Vancouver	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00668_.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00417_.WMF	SD.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\THROAT.WAV.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg	SD.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01240_.GIF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js	SD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_ON.GIF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.PLAY	SD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua	SD.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OFFREL.DLL	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18225_.WMF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00200_.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\Sidebar.exe.mui	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35F.GIF	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css	SD.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcfr.dll.mui	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.gpd	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01300_.GIF.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Invite or Link.one.PLAY	SD.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui	SD.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID.PLAY	SD.exe

C:\Users\Admin\AppData\Local\Temp\SD.exe
"C:\Users\Admin\AppData\Local\Temp\SD.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:1612

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\desktop.ini
Filesize
1KB

MD5
54b68093f0ed510f4c5c58f1928eb4df

SHA1
d8de818338cd39412bb71b53ddb8c1efaaa07121

SHA256
c79dc3b95d3adf81a7003f8377f4e740f9720ce0ea461f145ec2272f4c6aff05

SHA512
aaf85fdd443d0de8ee3368bdd91b5ecd8c9a5eb1a59d18db3cf44a991e3acd5c633577a33cf4edb184c7b5c7837eb61303a4dae77dc1d786d83c8e142bc4f979

Download Submit
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x0000000000270000-0x000000000029C000-memory.dmp

Filesize
176KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads