Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 20:07 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZYu4eR.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZYu4eR.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ZYu4eR.exe
-
Size
458KB
-
MD5
a7220cc1827fca75b6e74efe59a8ea77
-
SHA1
836c066fff10ad423134f863528f4ec3d3e95962
-
SHA256
731457e4704d299b353e802b72a6908dfa2124cbb5130b8cb9a943c6be6bcdc6
-
SHA512
90cda9290fbc28187da837c4829fa1cd0084a58c87e58b6ddb0e70340b334507233bc0ab2c858462824e21babaaf2118dee68513e5c87fa7126d46bce5d38b21
-
SSDEEP
6144:4/MZO4aLcwC0IEVvO2UcxnwMSKY3m5MzrTV/yqUKmLzmZhbVPcK7lKWp+:4XiwC0pVvOwxSCirEXKPZh+Kdp+
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8480) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ZYu4eR.exe File opened for modification C:\Users\Admin\Links\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ZYu4eR.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-86725733-3001458681-3405935542-1000\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Documents\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ZYu4eR.exe File opened for modification C:\Program Files (x86)\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Videos\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Music\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Admin\Music\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ZYu4eR.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ZYu4eR.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: ZYu4eR.exe File opened (read-only) \??\E: ZYu4eR.exe File opened (read-only) \??\K: ZYu4eR.exe File opened (read-only) \??\M: ZYu4eR.exe File opened (read-only) \??\O: ZYu4eR.exe File opened (read-only) \??\P: ZYu4eR.exe File opened (read-only) \??\Q: ZYu4eR.exe File opened (read-only) \??\R: ZYu4eR.exe File opened (read-only) \??\U: ZYu4eR.exe File opened (read-only) \??\Z: ZYu4eR.exe File opened (read-only) \??\A: ZYu4eR.exe File opened (read-only) \??\G: ZYu4eR.exe File opened (read-only) \??\J: ZYu4eR.exe File opened (read-only) \??\W: ZYu4eR.exe File opened (read-only) \??\Y: ZYu4eR.exe File opened (read-only) \??\B: ZYu4eR.exe File opened (read-only) \??\I: ZYu4eR.exe File opened (read-only) \??\L: ZYu4eR.exe File opened (read-only) \??\N: ZYu4eR.exe File opened (read-only) \??\S: ZYu4eR.exe File opened (read-only) \??\X: ZYu4eR.exe File opened (read-only) \??\H: ZYu4eR.exe File opened (read-only) \??\V: ZYu4eR.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml ZYu4eR.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js ZYu4eR.exe File opened for modification C:\Program Files\GrantUnregister.css.PLAY ZYu4eR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png ZYu4eR.exe File opened for modification C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui ZYu4eR.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_ES.LEX ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02435_.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.PLAY ZYu4eR.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css ZYu4eR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239951.WMF ZYu4eR.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt.PLAY ZYu4eR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153265.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue.css ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF ZYu4eR.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10 ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01255G.GIF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar ZYu4eR.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.PLAY ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01358_.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.PLAY ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.PLAY ZYu4eR.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui ZYu4eR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF ZYu4eR.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF ZYu4eR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp ZYu4eR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png ZYu4eR.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac ZYu4eR.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5937c48233853189d65538e21d18e26de
SHA12ecedb3185e4d7b4d7c97fcbba1ff02bd7361051
SHA256b2a7a590a8b17d52d4fb7146242df571ae0c18ec5c3eb933a58233b2c216c8d6
SHA5128a9540e54b64f8ec807cda13c79c6c855abc9d0b12f129dd30ef4ab1207fbf8bb77dba8cc6223e4d3cdde46961b9856e3c012eb587cb75bdc56b0a65776bb7a7