Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe
Resource
win7-20231023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe
-
Size
458KB
-
MD5
0750794cd2b5823069bb9ff16ff6d2b7
-
SHA1
466874dbf01e0bd4e99cbd6b39ae69d1023b35f2
-
SHA256
23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c
-
SHA512
617b9bd914f9297ff2aa6d378de3746cf1701d6dd2e575934b987dceece16329c9a7ccbb52a19022977151918dfa2304777ecf9c3cef221c16453f5b869c2d25
-
SSDEEP
6144:7PMZuIF76gx04UVsSWvqZg8hKYjMZ8PaqzlvBaUamLzmZhLVPtkADlKHp+:7H7gx0JVsSNnkGLzHaPZhnkBp+
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Links\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Music\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Videos\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2085049433-1067986815-1244098655-1000\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Music\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Documents\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\E: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\M: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\G: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\O: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\Q: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\Y: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\B: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\J: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\N: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\S: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\U: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\V: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\W: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\X: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\H: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\I: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\K: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\L: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\P: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\R: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\T: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened (read-only) \??\Z: 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10268_.GIF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\localizedSettings.css 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309585.JPG 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\SERVWRAP.ASP 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205466.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.DPV 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Amman.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285808.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\FONTSCHM.INI 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240157.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01569_.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\TestCheckpoint.ADT 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174639.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.PLAY 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui 23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe"C:\Users\Admin\AppData\Local\Temp\23f757c619e418b14b72299af7b77cc6939dfd2ce7d094498446f2ce4961666c.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f4754b1d296a2aff0160997e7aa1b06
SHA1cd449e8a5b7df66f6dd36d58e14ebbfbae4d6058
SHA256e4f7dce45e5fb58e1fc4e23551906aac876c026ddf943e16bfe5739816b01c1b
SHA512b5304940b3d6cfec976e5c38641632d62014f504761da3c8302f1a39c3a258ec4295692432afa0349aeed0c3d57c99e384faeddd2da4b87f3244a9042c72315e