Overview

overview

10

Static

static

3

952fec5f9e...3f.exe

windows10-1703-x64

10

952fec5f9e...3f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1800s
  • max time network
    1225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2023, 12:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f.exe
  • Size 673KB
  • Sample230628-pt4essad8v
  • SHA256 952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
playransomwarespywarestealer

Malware Config

Signatures

  • PLAY Ransomware, PlayCrypt

    Ransomware family first seen in mid 2022.

    ransomwareplay
  • Renames multiple (8309) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 29 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 21 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f.exe
    "C:\Users\Admin\AppData\Local\Temp\952fec5f9e7137951700d7e4239728f903e360b3fdb0332deb9448bdc31c2f3f.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3204
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:51076
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:71424
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2840
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1572
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\TraceWrite.docx.PLAY"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2888
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:71628
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\TraceWrite.docx.PLAY
        2⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:66636
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:18580
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ExpandOpen.html.PLAY
        2⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:70028
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\ReadMe.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      • Suspicious use of FindShellTrayWindow
      PID:71580

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          desktop.ini
          • Path C:\$Recycle.Bin\S-1-5-21-922299981-3641064733-3870770889-1000\desktop.ini
          • Size 1KB
          • SHA256 401a6907fe93d6016a9dc4d66bb601ae526c6df929f588006f70ca8b16378e23
          • MD5 SHA1 SHA512
          Submit Download

          AcroRdrDCUpd1901020069.msp.PLAY
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp.PLAY
          • Size 218.2MB
          • SHA256 974aa720e3e8cbf4b03c3e7fccbeb12360d174dc1a19e2caea71260b09537540
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Data1.cab.PLAY
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab.PLAY
          • Size 167.0MB
          • SHA256 0fd640a563662b6a4b9d3756196231abed24777118f0c8fda84f8d37971ce8df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          abcpy.ini.PLAY
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini.PLAY
          • Size 1KB
          • SHA256 34b01ec923b81326794ec41a0125d86ddc7e8db3e27850220612d330a579754a
          • MD5 SHA1 SHA512
          Submit Download

          setup.ini.PLAY
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini.PLAY
          • Size 1KB
          • SHA256 1ad500986fd70fbd7889bb3b80db910fdb93f21725cdff440ae18d9dd9b5655b
          • MD5 SHA1 SHA512
          Submit Download

          refcount.ini.PLAY
          • Path C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.PLAY
          • Size 1KB
          • SHA256 5f6fbe7a9bbca5fc85fea17c69af99b9c14ca2d014fb98537dbaf83ecf6f807c
          • MD5 SHA1 SHA512
          Submit Download

          update-config.json.PLAY
          • Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json.PLAY
          • Size 1KB
          • SHA256 b1b9029581f32f5dd6ebd61128d0c0ea604a7781bbc1b29da2b85c07b0ab4e0a
          • MD5 SHA1 SHA512
          Submit Download

          baseimagefam8.PLAY
          • Path C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8.PLAY
          • Size 78.7MB
          • SHA256 16c6438e9933459fbbadadc1d38da673b61eb66a30b93da4e508b1ae967a6190
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          java.settings.cfg.PLAY
          • Path C:\ProgramData\Oracle\Java\java.settings.cfg.PLAY
          • Size 1KB
          • SHA256 b2a8ea61dfc4c6607fb65aebb640495043489d267c052d011be66ea709f1d10c
          • MD5 SHA1 SHA512
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.PLAY
          • Size 1KB
          • SHA256 7e62f478f7ee0a2ed4b5ee0baf1c6eee6ce19f2650de888514effa855a30d8d1
          • MD5 SHA1 SHA512
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY
          • Size 5.5MB
          • SHA256 91c2746571f351b5601bb58bdbe28e56273c3806cd16cd8a45aff8fb87dea219
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.PLAY
          • Size 1KB
          • SHA256 0f870d04d7cc2952b4a0bc45769af2f551b196288eb50dcd250b303ac3a0c27f
          • MD5 SHA1 SHA512
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY
          • Size 5.3MB
          • SHA256 10953c72245605dd3bf86f4e2a854c37df00489a660f4f725bc4276fef33c2fe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.PLAY
          • Size 1KB
          • SHA256 79c85de002564d5dbaaa1c12faf351fd52f81055c4f5634c403983ec11259bb4
          • MD5 SHA1 SHA512
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.PLAY
          • Size 1KB
          • SHA256 34bfc6b47a4b74e1262f2510bb1cebd5317378795f32f2d887708caf299efee6
          • MD5 SHA1 SHA512
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY
          • Size 870KB
          • SHA256 6dbe1c459276b24f56ef1735cfb3e83986368627acdf6f4337cb7db80728d7f0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY
          • Size 5.4MB
          • SHA256 596d7dec97878888454643b0b5758633d1ece1aaed343709a497a00ab2a8125f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY
          • Size 4.7MB
          • SHA256 50dfec72f03507b062d033b4f89a6b38652b55aaa7566e2d6c1b735791cdb151
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY
          • Size 4.9MB
          • SHA256 a45e7c2461044caf0fddcb65c1ab01ab6a345c47135cabf5dfcdae34c54bb26b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY
          • Size 803KB
          • SHA256 6d54faf6c6cfa3377a14edfc49bd59c0d2891cadec23728e04f526d5e70cfc05
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY
          • Size 4.9MB
          • SHA256 ebab74acc31964467c8ef8d7c1104f0c40bc79b03b683cb9605e95fb78b8627f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY
          • Size 1011KB
          • SHA256 f6666ce00f6d535e2cc9defc7b709b6b3f14c6dcfca3f3f2094012a7ea665eb3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY
          • Size 791KB
          • SHA256 6a2fd0d72672282a79c9f2824be71801e4c681b313a79c6f1611d326722caa08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY
          • Size 974KB
          • SHA256 740b7e76a69c26cdb6c84ee06d6bcbd1925b90c0bf2a0867a857f05c21a92f69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cab1.cab.PLAY
          • Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY
          • Size 742KB
          • SHA256 4fe47a4bdbd236bd95dd5b1d7ad6db8a714a5be393106a1c8582b73800840201
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.PLAY
          • Size 1KB
          • SHA256 c8c82d15063844de849f97c842f91d5025b21c9082f6450437d044fa3f23050c
          • MD5 SHA1 SHA512
          Submit Download

          state.rsm.PLAY
          • Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.PLAY
          • Size 1KB
          • SHA256 7c4c93f3eb9660fde09e5ff14e155b61cdf18f03bbc24ee607d06c9bcd94c1aa
          • MD5 SHA1 SHA512
          Submit Download

          regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.PLAY
          • Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.PLAY
          • Size 2KB
          • SHA256 e26b85ea955f5c7121ba8f14539215647201f881bfe072dd74c890dc5aa3327b
          • MD5 SHA1 SHA512
          Submit Download

          regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.PLAY
          • Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.PLAY
          • Size 2KB
          • SHA256 fb7adf0ef1920239a5536bb9d9f2efaf33b2ae40bedf0d7094e39c646360b86b
          • MD5 SHA1 SHA512
          Submit Download

          regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.PLAY
          • Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.PLAY
          • Size 2KB
          • SHA256 a9d40783ebaca9a91fd432ef6840eafd1ccb536f77c0c76cc71e3df610f5a33a
          • MD5 SHA1 SHA512
          Submit Download

          regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.PLAY
          • Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.PLAY
          • Size 2KB
          • SHA256 203b4e4b9e0f170195b4f1884711a5edb52f389cba401f891484531ccdef8c6b
          • MD5 SHA1 SHA512
          Submit Download

          ReadMe.txt
          • Path C:\ReadMe.txt
          • Size 30B
          • SHA256 7a4fcdb7e62b5267b21681a93fe4aca5ee72d3fdf17c1227d372437a10c0bc61
          • MD5 SHA1 SHA512
          Submit Download

          ExpandOpen.html.PLAY
          • Path C:\Users\Admin\Desktop\ExpandOpen.html.PLAY
          • Size 275KB
          • SHA256 c0ba467cb2920f3b333cee8a1723403ee443a2c3de95e093e8f4d7e2cc4cc4ca
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          TraceWrite.docx.PLAY
          • Path C:\Users\Admin\Desktop\TraceWrite.docx.PLAY
          • Size 220KB
          • SHA256 309be19b761dc28e0b9e99c0dd4d60b94d1a8e283943c5fd4d8d778b39504032
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/3204-133-0x00000000007B0000-0x00000000007DC000-memory.dmp
          Download