Resubmissions
12/06/2024, 22:11
240612-135j1asekc 1012/06/2024, 20:56
240612-zq6qvstekp 1028/05/2024, 13:15
240528-qg9aysfh38 1027/05/2024, 20:52
240527-zn2dcshf8x 10Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2TXt7S.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2TXt7S.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2TXt7S.exe
-
Size
326KB
-
MD5
21413e789eea9d581d047df32fad7fa7
-
SHA1
c361103da37aff0216281781dff09fa5c079864b
-
SHA256
7bc87a26137cc07cabf31e6e4bcd0e514846b5dd727a29132919f2e6b317cde8
-
SHA512
cd6bd0f43b0385a392395add3108134d8aeb62cea3ed470ddfeea66ac096cc6de5e85bc2dda3798a13437ae4b6c38580a3b2e24143db1835c88d268b2ec570c4
-
SSDEEP
6144:fXqpIW/yostkBUPSuLWT9Dj4IByRuE3AzJNxRGI20JE:/q2W/7+kBuqjKuE6NxAn0JE
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8531) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2TXt7S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2TXt7S.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 2TXt7S.exe File opened (read-only) \??\A: 2TXt7S.exe File opened (read-only) \??\P: 2TXt7S.exe File opened (read-only) \??\I: 2TXt7S.exe File opened (read-only) \??\O: 2TXt7S.exe File opened (read-only) \??\Q: 2TXt7S.exe File opened (read-only) \??\R: 2TXt7S.exe File opened (read-only) \??\S: 2TXt7S.exe File opened (read-only) \??\W: 2TXt7S.exe File opened (read-only) \??\B: 2TXt7S.exe File opened (read-only) \??\H: 2TXt7S.exe File opened (read-only) \??\K: 2TXt7S.exe File opened (read-only) \??\M: 2TXt7S.exe File opened (read-only) \??\T: 2TXt7S.exe File opened (read-only) \??\V: 2TXt7S.exe File opened (read-only) \??\Y: 2TXt7S.exe File opened (read-only) \??\Z: 2TXt7S.exe File opened (read-only) \??\E: 2TXt7S.exe File opened (read-only) \??\G: 2TXt7S.exe File opened (read-only) \??\N: 2TXt7S.exe File opened (read-only) \??\X: 2TXt7S.exe File opened (read-only) \??\J: 2TXt7S.exe File opened (read-only) \??\L: 2TXt7S.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_F_COL.HXK 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQS.ICO 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUISet.XML 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\YEAR.XSL 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV 2TXt7S.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf 2TXt7S.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 2TXt7S.exe File opened for modification C:\Program Files\SearchPush.mp4.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter 2TXt7S.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.ELM 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RSPMECH.POC 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\COMPUTER.ICO 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\GRAY.pf 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieNewsletter.dotx 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_ON.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml 2TXt7S.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Damascus 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.DPV 2TXt7S.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR18F.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWSTRUCT.DLL 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.PLAY 2TXt7S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo 2TXt7S.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5efdce897fe360db36b70406a10d72ef6
SHA1913b7b833aaa686ff716a62ddb97155d8070cc1a
SHA256592c6f85160c60e0ca5c6ce3110bd9d84755b60fc1cd15a3b4c211be378d096d
SHA5125cb3f95c328ad65a8ccb1a72aaf58161becd73d35f30de0674086c08059ca38b3427d0a0590116d6a2d7c2e1fc911cc34599c97690b6ee3632023cf06e392cb8