Resubmissions
07/03/2023, 07:25
230307-h9eytahc251007/03/2023, 07:22
230307-h7dyqsge9v1007/02/2023, 09:44
230207-lqgvvaah6307/02/2023, 04:27
230207-e28dlshd371007/02/2023, 04:11
230207-er315sce2y1002/02/2023, 13:29
230202-qrj4tagh341002/02/2023, 13:09
230202-qd156sad6z1026/01/2023, 07:55
230126-jsjfcada551008/09/2022, 09:29
220908-lgbmgaebd8801/09/2022, 20:56
220901-zq1jvadbg28Analysis
- max time kernel
300s - max time network
295s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
26/01/2023, 07:55
Behavioral task
behavioral1
Sample
PLAY.mal_.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
300 seconds
General
- Target PLAY.mal_.exe
- Size 178KB
- Sample230126-jsjfcada55
- SHA256 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
- MD5 223eff1610b432a1f1aa06c60bd7b9a6
- SHA1 14177730443c65aefeeda3162b324fdedf9cf9e0
- SHA512 cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
- SSDEEP 3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GroupGet.tif => C:\Users\Admin\Pictures\GroupGet.tif.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\ConnectRead.crw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\ConvertClose.crw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\GroupGet.tif.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\ConnectRead.crw => C:\Users\Admin\Pictures\ConnectRead.crw.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\ConvertClose.crw => C:\Users\Admin\Pictures\ConvertClose.crw.PLAY PLAY.mal_.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI PLAY.mal_.exe File opened for modification C:\Users\Admin\Links\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Music\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Downloads\desktop.ini PLAY.mal_.exe File opened for modification C:\Program Files (x86)\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Searches\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Videos\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Libraries\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Desktop\desktop.ini PLAY.mal_.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\desktop.ini PLAY.mal_.exe File opened for modification C:\Program Files\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Documents\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Music\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Documents\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Videos\desktop.ini PLAY.mal_.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: PLAY.mal_.exe File opened (read-only) \??\V: PLAY.mal_.exe File opened (read-only) \??\Y: PLAY.mal_.exe File opened (read-only) \??\I: PLAY.mal_.exe File opened (read-only) \??\J: PLAY.mal_.exe File opened (read-only) \??\K: PLAY.mal_.exe File opened (read-only) \??\Q: PLAY.mal_.exe File opened (read-only) \??\T: PLAY.mal_.exe File opened (read-only) \??\U: PLAY.mal_.exe File opened (read-only) \??\W: PLAY.mal_.exe File opened (read-only) \??\Z: PLAY.mal_.exe File opened (read-only) \??\A: PLAY.mal_.exe File opened (read-only) \??\B: PLAY.mal_.exe File opened (read-only) \??\H: PLAY.mal_.exe File opened (read-only) \??\M: PLAY.mal_.exe File opened (read-only) \??\N: PLAY.mal_.exe File opened (read-only) \??\O: PLAY.mal_.exe File opened (read-only) \??\R: PLAY.mal_.exe File opened (read-only) \??\E: PLAY.mal_.exe File opened (read-only) \??\G: PLAY.mal_.exe File opened (read-only) \??\L: PLAY.mal_.exe File opened (read-only) \??\P: PLAY.mal_.exe File opened (read-only) \??\S: PLAY.mal_.exe File opened (read-only) \??\X: PLAY.mal_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\8.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyStoryCover.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-100.png PLAY.mal_.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files\BlockProtect.pub.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-300.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-100_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook2x.png PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\SETUP.CHM PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-48.png PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-20_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_altform-unplated.png PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\GLTFTextTemplate.json PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms PLAY.mal_.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2971393436-602173351-1645505021-1000\desktop.ini
- Size 1KB
- SHA256 cb8169018ea3a32a403c8fbb77c72dad890a644fc9b4b72ad904ce113bebc1f4
- MD5 9931476fa435417549d776d72fcb6542
- SHA1 ab7664434e6608f788cee8dc3741e94101313e4a
- SHA512 b4036b5331f81cecc1fd254737c1a79967f617838ddd15e280ee643cf8a88a476f8e6bb53ec9b0c6a11054381427ff3898340639d1d97241cbe90cec0375f7cc
- MD5 SHA1 SHA512