Resubmissions

29-11-2022 14:17

221129-rlwq4aga85 10

29-11-2022 12:11

221129-pcwcvsge48 10

29-11-2022 11:21

221129-ngaraadf99 10

General

  • Target

    SD.exe.bak

  • Size

    501KB

  • Sample

    221129-pcwcvsge48

  • MD5

    6ea4b9b0ad0692892f6e4f1b4f05aa72

  • SHA1

    3bb50ceeaa8a698687863dd44e149214d4372601

  • SHA256

    757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280

  • SHA512

    f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48

  • SSDEEP

    6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN

Score
10/10

Malware Config

Targets

    • Target

      SD.exe.bak

    • Size

      501KB

    • MD5

      6ea4b9b0ad0692892f6e4f1b4f05aa72

    • SHA1

      3bb50ceeaa8a698687863dd44e149214d4372601

    • SHA256

      757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280

    • SHA512

      f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48

    • SSDEEP

      6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN

    Score
    10/10
    • PLAY Ransomware, PlayCrypt

      Ransomware family first seen in mid 2022.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks