Resubmissions
12/06/2024, 22:11
240612-135j1asekc 1012/06/2024, 20:56
240612-zq6qvstekp 1028/05/2024, 13:15
240528-qg9aysfh38 1027/05/2024, 20:52
240527-zn2dcshf8x 10Analysis
-
max time kernel
104s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2TXt7S.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2TXt7S.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2TXt7S.exe
-
Size
326KB
-
MD5
21413e789eea9d581d047df32fad7fa7
-
SHA1
c361103da37aff0216281781dff09fa5c079864b
-
SHA256
7bc87a26137cc07cabf31e6e4bcd0e514846b5dd727a29132919f2e6b317cde8
-
SHA512
cd6bd0f43b0385a392395add3108134d8aeb62cea3ed470ddfeea66ac096cc6de5e85bc2dda3798a13437ae4b6c38580a3b2e24143db1835c88d268b2ec570c4
-
SSDEEP
6144:fXqpIW/yostkBUPSuLWT9Dj4IByRuE3AzJNxRGI20JE:/q2W/7+kBuqjKuE6NxAn0JE
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (7318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Contacts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2TXt7S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2TXt7S.exe File opened for modification C:\Program Files (x86)\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2TXt7S.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2TXt7S.exe File opened (read-only) \??\X: 2TXt7S.exe File opened (read-only) \??\A: 2TXt7S.exe File opened (read-only) \??\B: 2TXt7S.exe File opened (read-only) \??\L: 2TXt7S.exe File opened (read-only) \??\N: 2TXt7S.exe File opened (read-only) \??\R: 2TXt7S.exe File opened (read-only) \??\I: 2TXt7S.exe File opened (read-only) \??\K: 2TXt7S.exe File opened (read-only) \??\M: 2TXt7S.exe File opened (read-only) \??\O: 2TXt7S.exe File opened (read-only) \??\Z: 2TXt7S.exe File opened (read-only) \??\E: 2TXt7S.exe File opened (read-only) \??\P: 2TXt7S.exe File opened (read-only) \??\T: 2TXt7S.exe File opened (read-only) \??\W: 2TXt7S.exe File opened (read-only) \??\U: 2TXt7S.exe File opened (read-only) \??\V: 2TXt7S.exe File opened (read-only) \??\Y: 2TXt7S.exe File opened (read-only) \??\G: 2TXt7S.exe File opened (read-only) \??\H: 2TXt7S.exe File opened (read-only) \??\J: 2TXt7S.exe File opened (read-only) \??\Q: 2TXt7S.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteAudio_RecordingPlayback.gif 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-20.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\27.jpg 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\java.security 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-250.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xeccf.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_contrast-black.png 2TXt7S.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-150.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-125.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Reconnected.m4a 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\MedTile.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsLargeTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\MedTile.scale-125.png 2TXt7S.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\calendars.properties.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-32_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\BhaiMDL2.2.52.ttf 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\GLTFTextTemplate.json 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\Icon_Xbox_PhotosSplashWideTile.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\WideTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\share.svg 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur 2TXt7S.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-250.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_PigEar.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\MedTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72.png 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogo.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-200.png 2TXt7S.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b9ab838ccb049a42a59f139aeb213327
SHA1f25cf92cc38cf2420f9ed96aea19e9e34746b77f
SHA256a85c11933555e2232b63fd9622ace53b1f5518cbd0a6b1644c68a83a9adc44fc
SHA51209b8edf698dd14b204e33e27d1902ab83072bc7850501cc10bf69d352387f54c9494e615d0e4cfbf4ef6941d41322e851307a41d67aba977465ce3543ae85e14