play | 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55

General

Target

PLAY.mal_.exe
Size

178KB
MD5

223eff1610b432a1f1aa06c60bd7b9a6
SHA1

14177730443c65aefeeda3162b324fdedf9cf9e0
SHA256

006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
SHA512

cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
SSDEEP

3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17

Score

10^/10

play ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

PLAY.mal_.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CopyMeasure.tiff.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\InstallExpand.raw.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertDisable.tiff	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\CopyMeasure.tiff	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\ConvertDisable.tiff => C:\Users\Admin\Pictures\ConvertDisable.tiff.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\CompareMerge.crw.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertDisable.tiff.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\ProtectSuspend.raw.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\InstallExpand.raw => C:\Users\Admin\Pictures\InstallExpand.raw.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\CopyMeasure.tiff => C:\Users\Admin\Pictures\CopyMeasure.tiff.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\CompareMerge.crw => C:\Users\Admin\Pictures\CompareMerge.crw.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\ProtectSuspend.raw => C:\Users\Admin\Pictures\ProtectSuspend.raw.PLAY	PLAY.mal_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 29 IoCs

Processes:

PLAY.mal_.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	PLAY.mal_.exe
File opened for modification	C:\Users\Public\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2386679933-1492765628-3466841596-1000\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PLAY.mal_.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PLAY.mal_.exe

description	ioc	process
File opened (read-only)	\??\U:	PLAY.mal_.exe
File opened (read-only)	\??\X:	PLAY.mal_.exe
File opened (read-only)	\??\A:	PLAY.mal_.exe
File opened (read-only)	\??\I:	PLAY.mal_.exe
File opened (read-only)	\??\K:	PLAY.mal_.exe
File opened (read-only)	\??\O:	PLAY.mal_.exe
File opened (read-only)	\??\L:	PLAY.mal_.exe
File opened (read-only)	\??\M:	PLAY.mal_.exe
File opened (read-only)	\??\T:	PLAY.mal_.exe
File opened (read-only)	\??\V:	PLAY.mal_.exe
File opened (read-only)	\??\P:	PLAY.mal_.exe
File opened (read-only)	\??\Q:	PLAY.mal_.exe
File opened (read-only)	\??\R:	PLAY.mal_.exe
File opened (read-only)	\??\S:	PLAY.mal_.exe
File opened (read-only)	\??\B:	PLAY.mal_.exe
File opened (read-only)	\??\E:	PLAY.mal_.exe
File opened (read-only)	\??\H:	PLAY.mal_.exe
File opened (read-only)	\??\J:	PLAY.mal_.exe
File opened (read-only)	\??\W:	PLAY.mal_.exe
File opened (read-only)	\??\Z:	PLAY.mal_.exe
File opened (read-only)	\??\F:	PLAY.mal_.exe
File opened (read-only)	\??\G:	PLAY.mal_.exe
File opened (read-only)	\??\N:	PLAY.mal_.exe
File opened (read-only)	\??\Y:	PLAY.mal_.exe

Drops file in Program Files directory 64 IoCs

Processes:

PLAY.mal_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PREVIEW.GIF	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.winmd	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\officons.ttf	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-white.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\NATIVESHIM.RESOURCES.DLL	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\ThreeWayBlendPage.xbf	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\LEVEL.ELM.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ja.properties	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-100_contrast-black.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsym.ttf	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-150.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\28.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-400.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-150.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_contrast-white.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_permission_android.gif	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp.PLAY	PLAY.mal_.exe

C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe
"C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2386679933-1492765628-3466841596-1000\desktop.ini
Filesize
1KB

MD5
9ac69f21de173cccd8aec5f13ba81e9b

SHA1
5c1c54768c6ee9c00ec64ea456433f01eb23a96e

SHA256
fe1f348bec1f543e3565a26c6262194e766ea7a1f49b1b9b61d83cfcb64939d1

SHA512
91bc2f20e35fbca71e63f01fe0d0c908367c1d329fde5498ac9b508181d71d1aa53f15e51c7f295af22b2a4741bf9fe0496244bdb5eadb2311f4f47f3aadbf22

Download Submit
memory/4884-132-0x0000000002B20000-0x0000000002B4C000-memory.dmp

Filesize
176KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads