Resubmissions
07/03/2023, 07:25
230307-h9eytahc251007/03/2023, 07:22
230307-h7dyqsge9v1007/02/2023, 09:44
230207-lqgvvaah6307/02/2023, 04:27
230207-e28dlshd371007/02/2023, 04:11
230207-er315sce2y1002/02/2023, 13:29
230202-qrj4tagh341002/02/2023, 13:09
230202-qd156sad6z1026/01/2023, 07:55
230126-jsjfcada551008/09/2022, 09:29
220908-lgbmgaebd8801/09/2022, 20:56
220901-zq1jvadbg28Analysis
- max time kernel
1200s - max time network
963s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
07/02/2023, 04:27
Behavioral task
behavioral1
Sample
PLAY.mal_.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
PLAY.mal_.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
1200 seconds
General
- Target PLAY.mal_.exe
- Size 178KB
- Sample230207-e28dlshd37
- SHA256 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
- MD5 223eff1610b432a1f1aa06c60bd7b9a6
- SHA1 14177730443c65aefeeda3162b324fdedf9cf9e0
- SHA512 cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
- SSDEEP 3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Modifies extensions of user files 21 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RequestSave.tiff => C:\Users\Admin\Pictures\RequestSave.tiff.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\SearchOpen.tif => C:\Users\Admin\Pictures\SearchOpen.tif.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\InvokeRegister.png.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\SwitchUpdate.crw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\RequestSave.tiff PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\ReadAdd.crw => C:\Users\Admin\Pictures\ReadAdd.crw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\HideRestart.tiff.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\HideRestart.tiff PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\SwitchUpdate.crw => C:\Users\Admin\Pictures\SwitchUpdate.crw.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\InvokeRegister.png => C:\Users\Admin\Pictures\InvokeRegister.png.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\HideRestart.tiff => C:\Users\Admin\Pictures\HideRestart.tiff.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\FormatOpen.tiff.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\RequestSave.tiff.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\SearchOpen.tif.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\WriteResolve.raw.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\AddRedo.raw => C:\Users\Admin\Pictures\AddRedo.raw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\FormatOpen.tiff PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\AddRedo.raw.PLAY PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\ReadAdd.crw.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\FormatOpen.tiff => C:\Users\Admin\Pictures\FormatOpen.tiff.PLAY PLAY.mal_.exe File renamed C:\Users\Admin\Pictures\WriteResolve.raw => C:\Users\Admin\Pictures\WriteResolve.raw.PLAY PLAY.mal_.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Searches\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Libraries\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Music\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Music\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Desktop\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Documents\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Videos\desktop.ini PLAY.mal_.exe File opened for modification C:\Program Files\desktop.ini PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI PLAY.mal_.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Links\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Videos\desktop.ini PLAY.mal_.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4246620582-653642754-1174164128-1000\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Documents\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini PLAY.mal_.exe File opened for modification C:\Program Files (x86)\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini PLAY.mal_.exe File opened for modification C:\Users\Public\Downloads\desktop.ini PLAY.mal_.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: PLAY.mal_.exe File opened (read-only) \??\V: PLAY.mal_.exe File opened (read-only) \??\W: PLAY.mal_.exe File opened (read-only) \??\Z: PLAY.mal_.exe File opened (read-only) \??\A: PLAY.mal_.exe File opened (read-only) \??\F: PLAY.mal_.exe File opened (read-only) \??\K: PLAY.mal_.exe File opened (read-only) \??\M: PLAY.mal_.exe File opened (read-only) \??\G: PLAY.mal_.exe File opened (read-only) \??\P: PLAY.mal_.exe File opened (read-only) \??\S: PLAY.mal_.exe File opened (read-only) \??\T: PLAY.mal_.exe File opened (read-only) \??\O: PLAY.mal_.exe File opened (read-only) \??\R: PLAY.mal_.exe File opened (read-only) \??\X: PLAY.mal_.exe File opened (read-only) \??\Y: PLAY.mal_.exe File opened (read-only) \??\B: PLAY.mal_.exe File opened (read-only) \??\H: PLAY.mal_.exe File opened (read-only) \??\J: PLAY.mal_.exe File opened (read-only) \??\L: PLAY.mal_.exe File opened (read-only) \??\E: PLAY.mal_.exe File opened (read-only) \??\I: PLAY.mal_.exe File opened (read-only) \??\Q: PLAY.mal_.exe File opened (read-only) \??\U: PLAY.mal_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.INF PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_id.json PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SegXbox2.ttf PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\Shield.targetsize-44.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PREVIEW.GIF.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_selected_18.svg.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256_altform-unplated.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_cancel_18.svg PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Rainbow.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview-hover.svg PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\SmallTile.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-125.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-150_contrast-black.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmMDL2.ttf PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-400.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSmallTile.scale-200.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoSearchResults_180x160.svg PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\cursors.properties PLAY.mal_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-white_scale-100.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbDownOutline_22_N1.svg PLAY.mal_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.PLAY PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\ui-strings.js.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MusicStoreLogo.scale-125_contrast-black.png PLAY.mal_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf.PLAY PLAY.mal_.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt PLAY.mal_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 PLAY.mal_.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4246620582-653642754-1174164128-1000\desktop.ini
- Size 1KB
- SHA256 2324bdcd2f0d0a27fbe71c42eaae595c974dd0ea4d7d53fe43dc418c3b2634ec
- MD5 f86da9e87bfacdf2a99bcc3ea0cf6368
- SHA1 a7340b2b97f4b9f1c1c18aaf85a0d60e74db44b0
- SHA512 2d862754684a26eb2e09f14340efd3433eb3476cd9ad33d5290d07d815c357bef6ca6491563404b64e7dcce57ae6d4f03269eacd30e83a22938d918f014b2578
- MD5 SHA1 SHA512