Analysis
- max time kernel
60s - max time network
75s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system - submitted
28/06/2023, 08:00
Behavioral task
behavioral1
Sample
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Resource
win10-20230621-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
7 signatures
1800 seconds
General
- Target 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
- Size 178KB
- Sample230628-jv4t3agg34
- SHA256 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
- MD5 223eff1610b432a1f1aa06c60bd7b9a6
- SHA1 14177730443c65aefeeda3162b324fdedf9cf9e0
- SHA512 cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
- SSDEEP 3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Renames multiple (8267) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantCheckpoint.png => C:\Users\Admin\Pictures\GrantCheckpoint.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\PingSelect.tif => C:\Users\Admin\Pictures\PingSelect.tif.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\PublishGrant.png => C:\Users\Admin\Pictures\PublishGrant.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\MountCompare.tiff => C:\Users\Admin\Pictures\MountCompare.tiff.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\SetRestore.raw => C:\Users\Admin\Pictures\SetRestore.raw.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\DisconnectUnprotect.raw => C:\Users\Admin\Pictures\DisconnectUnprotect.raw.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\MountCompare.tiff 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File renamed C:\Users\Admin\Pictures\EditUnregister.crw => C:\Users\Admin\Pictures\EditUnregister.crw.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 20 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Music\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3259792829-1422303781-2047321929-1000\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Links\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\P: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\T: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Z: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\W: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\X: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\E: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\I: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\J: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\N: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\S: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\V: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\B: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\G: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\O: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Y: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\U: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\A: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\H: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\K: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\L: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Q: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\R: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\resources.pri 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\View3d\3DViewerProductDescription-universal.xml 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-36_altform-unplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-unplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_de.properties 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-white_scale-125.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxManifest.xml 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\avatar_round_mask.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppUpdate.svg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-48_altform-unplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\selector.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-unplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_EyeLookingUp.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-125.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLargeTile.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.NetworkTroubleshooter.winmd 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-200.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-125.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-100_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\FavoriteDark.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\6.jpg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview-hover.svg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.strings.psd1 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe"C:\Users\Admin\AppData\Local\Temp\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:1452
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3259792829-1422303781-2047321929-1000\desktop.ini
- Size 1KB
- SHA256 18c649b9fcfa0147f3b972c15a7b7e6da5388861bdf51b67feeba558aa66e0f9
- MD5 d992b6f08b5b175f5907f63aa97f53d2
- SHA1 3f17c518ddde3a0b28de3cff250a7ae7cf4164ef
- SHA512 1b1a9340fb5ebaf7da324b80e04fc308e02f600a8cfb8f2f9faf5f3158831fbbf35bda434da51477acb7d17696bd75ab8db52002f3792767780754db30abe32e
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-3259792829-1422303781-2047321929-1000\desktop.ini
- Size 1KB
- SHA256 c6a9689250226c93b1c756ffea35f74293ce05ec13f01f908d425cf08989193d
- MD5 b87654cdcc98c2dbe420b11134cb007d
- SHA1 879ee2d2f5678485297d37f44732470a8313c719
- SHA512 07fda002fc2a2a22912ee1a0fab8fbdb20ecfacf176b16986f6dd1cacdcbda88d1cd1ab9c2c1f6fba7bbd9ce2d56d178df372e2e54135f51b31717c764af5a3d
- MD5 SHA1 SHA512