Resubmissions
29/11/2022, 14:17
221129-rlwq4aga851029/11/2022, 12:11
221129-pcwcvsge481029/11/2022, 11:21
221129-ngaraadf9910Analysis
- max time kernel
602s - max time network
605s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
SD.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
SD.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
600 seconds
General
- Target SD.exe
- Size 501KB
- Sample221129-rlwq4aga85
- SHA256 757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280
- MD5 6ea4b9b0ad0692892f6e4f1b4f05aa72
- SHA1 3bb50ceeaa8a698687863dd44e149214d4372601
- SHA512 f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48
- SSDEEP 6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SyncSubmit.crw.PLAY SD.exe File renamed C:\Users\Admin\Pictures\CompareDismount.raw => C:\Users\Admin\Pictures\CompareDismount.raw.PLAY SD.exe File renamed C:\Users\Admin\Pictures\SyncSubmit.crw => C:\Users\Admin\Pictures\SyncSubmit.crw.PLAY SD.exe File opened for modification C:\Users\Admin\Pictures\CompareDismount.raw.PLAY SD.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini SD.exe File opened for modification C:\Users\Public\Desktop\desktop.ini SD.exe File opened for modification C:\Users\Public\Documents\desktop.ini SD.exe File opened for modification C:\Program Files (x86)\desktop.ini SD.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini SD.exe File opened for modification C:\Users\Admin\Searches\desktop.ini SD.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini SD.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI SD.exe File opened for modification C:\Users\Public\desktop.ini SD.exe File opened for modification C:\Users\Public\Downloads\desktop.ini SD.exe File opened for modification C:\Users\Public\Libraries\desktop.ini SD.exe File opened for modification C:\Users\Public\Videos\desktop.ini SD.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini SD.exe File opened for modification C:\Users\Admin\Links\desktop.ini SD.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini SD.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini SD.exe File opened for modification C:\Users\Public\Pictures\desktop.ini SD.exe File opened for modification C:\Users\Admin\Documents\desktop.ini SD.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SD.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini SD.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini SD.exe File opened for modification C:\Users\Admin\Music\desktop.ini SD.exe File opened for modification C:\Users\Admin\Videos\desktop.ini SD.exe File opened for modification C:\Users\Public\Music\desktop.ini SD.exe File opened for modification C:\Program Files\desktop.ini SD.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini SD.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini SD.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SD.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: SD.exe File opened (read-only) \??\Q: SD.exe File opened (read-only) \??\V: SD.exe File opened (read-only) \??\A: SD.exe File opened (read-only) \??\B: SD.exe File opened (read-only) \??\F: SD.exe File opened (read-only) \??\H: SD.exe File opened (read-only) \??\J: SD.exe File opened (read-only) \??\X: SD.exe File opened (read-only) \??\Z: SD.exe File opened (read-only) \??\G: SD.exe File opened (read-only) \??\N: SD.exe File opened (read-only) \??\R: SD.exe File opened (read-only) \??\S: SD.exe File opened (read-only) \??\U: SD.exe File opened (read-only) \??\I: SD.exe File opened (read-only) \??\K: SD.exe File opened (read-only) \??\O: SD.exe File opened (read-only) \??\T: SD.exe File opened (read-only) \??\W: SD.exe File opened (read-only) \??\E: SD.exe File opened (read-only) \??\L: SD.exe File opened (read-only) \??\M: SD.exe File opened (read-only) \??\Y: SD.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-150.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.PLAY SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css.PLAY SD.exe File opened for modification C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM SD.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html SD.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.strings.psd1.PLAY SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-96.png SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODBC.DLL.PLAY SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js.PLAY SD.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125_contrast-white.png SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js.PLAY SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Entertainment.winmd SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-100.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js SD.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\el_get.svg SD.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\IETAG.DLL.PLAY SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg.PLAY SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-white.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_auditreport_18.svg SD.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72.png SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PartyChat.winmd SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\PSTN_phone.png SD.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-125.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\light.gif SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.jpg SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.PLAY SD.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1 SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.PLAY SD.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-US.pak SD.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar SD.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl SD.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-200.png SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js SD.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png SD.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.PLAY SD.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini
- Size 1KB
- SHA256 be227e2a39667968b200f20c7fbb484acd7333843ad55edde53269953e17538d
- MD5 07c5ed6ab22a279bc81d122a95c6cbde
- SHA1 13cca31d4b0fbaf709532b43359797429958f660
- SHA512 1488fd9b4015336eed1397b696ba0dc61412c9e8122fc9f81255ddcc741142f778b3744063a03642c6c8a26b229cc550ce67036a68a1a8f07ad3e45ae820b7b8
- MD5 SHA1 SHA512