Analysis
-
max time kernel
77s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2023 14:20
Behavioral task
behavioral1
Sample
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Resource
win10v2004-20230703-en
General
-
Target
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
-
Size
178KB
-
MD5
223eff1610b432a1f1aa06c60bd7b9a6
-
SHA1
14177730443c65aefeeda3162b324fdedf9cf9e0
-
SHA256
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
-
SHA512
cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
-
SSDEEP
3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
Processes:
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exedescription ioc process File opened for modification C:\Users\Public\Libraries\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Links\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Music\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Documents\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Music\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-618519468-4027732583-1827558364-1000\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Users\Public\Videos\desktop.ini 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exedescription ioc process File opened (read-only) \??\B: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\E: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\L: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\T: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\V: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\I: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\K: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\M: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\R: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\U: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\W: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Z: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\J: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\N: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\O: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\P: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Q: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\S: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\A: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\G: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\H: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\X: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened (read-only) \??\Y: 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe -
Drops file in Program Files directory 64 IoCs
Processes:
006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ko.properties 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48_altform-lightunplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\STRTEDGE.ELM.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.Upgrade.winmd 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-250.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-400.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-150.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCallbacks.h 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AudienceNetwork.winmd 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-200_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\index.txt 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-60.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.scale-100.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-400_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\NETWORK.ELM 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xeccf.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\DefaultResourceDictionary.xaml 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ui-strings.js.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons2x.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\169.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\1.jpg 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.password.template 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-72_altform-unplated_contrast-black.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_9_Loud.m4a 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-16_contrast-white.png 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.PLAY 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe\th-TH\Microsoft.UI.Xaml.Phone.dll.mui 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe"C:\Users\Admin\AppData\Local\Temp\006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD552da2963d30f231d9f964ded2989bf18
SHA1edbc12fe4fb33be9fbe9a3ba5d9fab4d98c884b0
SHA2568a30375366b4c81b91a43a052666f77b573f8dc3736e814d92744a2a0217a405
SHA5129e8f7c2d8470e677bcbb1db3ec7bc7565edbbcbacfbdf096859c132b25ef47ade5e1f57863adba502f59f7737a1975b890ccc62df64adb9690fe1009e80b3fbd