Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 20:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZYu4eR.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZYu4eR.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ZYu4eR.exe
-
Size
458KB
-
MD5
a7220cc1827fca75b6e74efe59a8ea77
-
SHA1
836c066fff10ad423134f863528f4ec3d3e95962
-
SHA256
731457e4704d299b353e802b72a6908dfa2124cbb5130b8cb9a943c6be6bcdc6
-
SHA512
90cda9290fbc28187da837c4829fa1cd0084a58c87e58b6ddb0e70340b334507233bc0ab2c858462824e21babaaf2118dee68513e5c87fa7126d46bce5d38b21
-
SSDEEP
6144:4/MZO4aLcwC0IEVvO2UcxnwMSKY3m5MzrTV/yqUKmLzmZhbVPcK7lKWp+:4XiwC0pVvOwxSCirEXKPZh+Kdp+
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (2936) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-919254492-3979293997-764407192-1000\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\desktop.ini ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ZYu4eR.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: ZYu4eR.exe File opened (read-only) \??\Q: ZYu4eR.exe File opened (read-only) \??\R: ZYu4eR.exe File opened (read-only) \??\S: ZYu4eR.exe File opened (read-only) \??\Z: ZYu4eR.exe File opened (read-only) \??\Y: ZYu4eR.exe File opened (read-only) \??\B: ZYu4eR.exe File opened (read-only) \??\G: ZYu4eR.exe File opened (read-only) \??\H: ZYu4eR.exe File opened (read-only) \??\I: ZYu4eR.exe File opened (read-only) \??\K: ZYu4eR.exe File opened (read-only) \??\O: ZYu4eR.exe File opened (read-only) \??\X: ZYu4eR.exe File opened (read-only) \??\J: ZYu4eR.exe File opened (read-only) \??\M: ZYu4eR.exe File opened (read-only) \??\W: ZYu4eR.exe File opened (read-only) \??\A: ZYu4eR.exe File opened (read-only) \??\E: ZYu4eR.exe File opened (read-only) \??\N: ZYu4eR.exe File opened (read-only) \??\P: ZYu4eR.exe File opened (read-only) \??\T: ZYu4eR.exe File opened (read-only) \??\U: ZYu4eR.exe File opened (read-only) \??\V: ZYu4eR.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP.bat ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt ZYu4eR.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core.xml ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar ZYu4eR.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui ZYu4eR.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties ZYu4eR.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\sRGB.pf ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms ZYu4eR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms ZYu4eR.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58496874598e6d7f8faf9f386d2831ced
SHA12212fa3422571cab1ed41508ccfd70f5d2ca13ea
SHA2565989ca29da8defd7b0d9e0a212b6c8583d6b419927b044f378c6b34097dc8449
SHA512880ad41cb04f79a6e4b7247ca64e29b2e888fc8fa6fd1f04a9c21fb2403d81e760186aa07bf50d6e959d283fc7f7473b442f27ec80c472eddd58a13793767a96