play | 757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280

Resubmissions

29/11/2022, 14:17

221129-rlwq4aga8510

29/11/2022, 12:11

221129-pcwcvsge4810

29/11/2022, 11:21

221129-ngaraadf9910

Analysis

max time kernel
356s
max time network
322s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SD.exe
Size 501KB
Sample221129-pcwcvsge48
SHA256 757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280
MD5 6ea4b9b0ad0692892f6e4f1b4f05aa72
SHA1 3bb50ceeaa8a698687863dd44e149214d4372601
SHA512 f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48
SSDEEP 6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

play ransomware

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4246620582-653642754-1174164128-1000\desktop.ini	SD.exe
File opened for modification	C:\Program Files\desktop.ini	SD.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SD.exe
File opened (read-only)	\??\V:	SD.exe
File opened (read-only)	\??\Y:	SD.exe
File opened (read-only)	\??\M:	SD.exe
File opened (read-only)	\??\R:	SD.exe
File opened (read-only)	\??\N:	SD.exe
File opened (read-only)	\??\Q:	SD.exe
File opened (read-only)	\??\T:	SD.exe
File opened (read-only)	\??\X:	SD.exe
File opened (read-only)	\??\Z:	SD.exe
File opened (read-only)	\??\G:	SD.exe
File opened (read-only)	\??\L:	SD.exe
File opened (read-only)	\??\H:	SD.exe
File opened (read-only)	\??\K:	SD.exe
File opened (read-only)	\??\O:	SD.exe
File opened (read-only)	\??\P:	SD.exe
File opened (read-only)	\??\W:	SD.exe
File opened (read-only)	\??\E:	SD.exe
File opened (read-only)	\??\F:	SD.exe
File opened (read-only)	\??\I:	SD.exe
File opened (read-only)	\??\J:	SD.exe
File opened (read-only)	\??\U:	SD.exe
File opened (read-only)	\??\A:	SD.exe
File opened (read-only)	\??\B:	SD.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png	SD.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\release	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_fr.properties	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	SD.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	SD.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar	SD.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\security\local_policy.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui	SD.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml	SD.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\meta-index	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.password.template	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms	SD.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	SD.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adojavas.inc	SD.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms	SD.exe

C:\Users\Admin\AppData\Local\Temp\SD.exe
"C:\Users\Admin\AppData\Local\Temp\SD.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:4136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-4246620582-653642754-1174164128-1000\desktop.ini
Size 1KB
SHA256 dda87151b75641246a4b925b86eb74e9ca4345d91c24dbe2d27bc893edfe3112
MD5 4dd971d760dd0bf1f92a8001316132b4
SHA1 5f0cbd44e4db7211eba9903852b4b46235d22603
SHA512 d0aad37cf28f83e06d571743477e5902101e0d95bde9b1602db3a20792612757235625181452b414103a4d9bc8c26d568d040fe25bc6f5ce8d741ed420dbcb4f
MD5 SHA1 SHA512

Submit Download

memory/4136-132-0x00000000029A0000-0x00000000029CC000-memory.dmp

Download