play | 757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280

General

Target

SD.exe
Size

501KB
MD5

6ea4b9b0ad0692892f6e4f1b4f05aa72
SHA1

3bb50ceeaa8a698687863dd44e149214d4372601
SHA256

757524b09e5d4f2399172c4ac0f6996ec34dec90110542973d438d5370aff280
SHA512

f5d603cabcf98193eb569d012a1434963a995d508f0580008b6463454bdd1fe02610e3797d2b28ef5f551d6d281a9d5b12efdad9bd6cdb51a796e4c077821e48
SSDEEP

6144:bouXuOPQveEDZSBdapQD0QYa5N2eAAHIbzAW1+SM/VyojODUSN:UiAmEQuQp7wbzd9JojMUSN

Score

10^/10

play ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\SyncSubmit.crw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\CompareDismount.raw => C:\Users\Admin\Pictures\CompareDismount.raw.PLAY	SD.exe
File renamed	C:\Users\Admin\Pictures\SyncSubmit.crw => C:\Users\Admin\Pictures\SyncSubmit.crw.PLAY	SD.exe
File opened for modification	C:\Users\Admin\Pictures\CompareDismount.raw.PLAY	SD.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 29 IoCs

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	SD.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	SD.exe
File opened for modification	C:\Users\Public\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	SD.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	SD.exe
File opened for modification	C:\Program Files\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	SD.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini	SD.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SD.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SD.exe

description	ioc	process
File opened (read-only)	\??\P:	SD.exe
File opened (read-only)	\??\Q:	SD.exe
File opened (read-only)	\??\V:	SD.exe
File opened (read-only)	\??\A:	SD.exe
File opened (read-only)	\??\B:	SD.exe
File opened (read-only)	\??\F:	SD.exe
File opened (read-only)	\??\H:	SD.exe
File opened (read-only)	\??\J:	SD.exe
File opened (read-only)	\??\X:	SD.exe
File opened (read-only)	\??\Z:	SD.exe
File opened (read-only)	\??\G:	SD.exe
File opened (read-only)	\??\N:	SD.exe
File opened (read-only)	\??\R:	SD.exe
File opened (read-only)	\??\S:	SD.exe
File opened (read-only)	\??\U:	SD.exe
File opened (read-only)	\??\I:	SD.exe
File opened (read-only)	\??\K:	SD.exe
File opened (read-only)	\??\O:	SD.exe
File opened (read-only)	\??\T:	SD.exe
File opened (read-only)	\??\W:	SD.exe
File opened (read-only)	\??\E:	SD.exe
File opened (read-only)	\??\L:	SD.exe
File opened (read-only)	\??\M:	SD.exe
File opened (read-only)	\??\Y:	SD.exe

Drops file in Program Files directory 64 IoCs

Processes:

SD.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-150.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css.PLAY	SD.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM	SD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	SD.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.strings.psd1.PLAY	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-96.png	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODBC.DLL.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js.PLAY	SD.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125_contrast-white.png	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js.PLAY	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Entertainment.winmd	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-100.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js	SD.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\el_get.svg	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\IETAG.DLL.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg.PLAY	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-white.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_auditreport_18.svg	SD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72.png	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PartyChat.winmd	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\PSTN_phone.png	SD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-125.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\light.gif	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.jpg	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.PLAY	SD.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.PLAY	SD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-US.pak	SD.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl	SD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-200.png	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js	SD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png	SD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.PLAY	SD.exe

C:\Users\Admin\AppData\Local\Temp\SD.exe
"C:\Users\Admin\AppData\Local\Temp\SD.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:4532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini
Filesize
1KB

MD5
07c5ed6ab22a279bc81d122a95c6cbde

SHA1
13cca31d4b0fbaf709532b43359797429958f660

SHA256
be227e2a39667968b200f20c7fbb484acd7333843ad55edde53269953e17538d

SHA512
1488fd9b4015336eed1397b696ba0dc61412c9e8122fc9f81255ddcc741142f778b3744063a03642c6c8a26b229cc550ce67036a68a1a8f07ad3e45ae820b7b8

Download Submit
memory/4532-132-0x0000000000E50000-0x0000000000E7C000-memory.dmp

Filesize
176KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads