Analysis
-
max time kernel
129s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2TXt7S.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2TXt7S.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2TXt7S.exe
-
Size
326KB
-
MD5
21413e789eea9d581d047df32fad7fa7
-
SHA1
c361103da37aff0216281781dff09fa5c079864b
-
SHA256
7bc87a26137cc07cabf31e6e4bcd0e514846b5dd727a29132919f2e6b317cde8
-
SHA512
cd6bd0f43b0385a392395add3108134d8aeb62cea3ed470ddfeea66ac096cc6de5e85bc2dda3798a13437ae4b6c38580a3b2e24143db1835c88d268b2ec570c4
-
SSDEEP
6144:fXqpIW/yostkBUPSuLWT9Dj4IByRuE3AzJNxRGI20JE:/q2W/7+kBuqjKuE6NxAn0JE
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (7315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Public\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2TXt7S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2TXt7S.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2TXt7S.exe File opened (read-only) \??\G: 2TXt7S.exe File opened (read-only) \??\H: 2TXt7S.exe File opened (read-only) \??\O: 2TXt7S.exe File opened (read-only) \??\Q: 2TXt7S.exe File opened (read-only) \??\T: 2TXt7S.exe File opened (read-only) \??\X: 2TXt7S.exe File opened (read-only) \??\A: 2TXt7S.exe File opened (read-only) \??\U: 2TXt7S.exe File opened (read-only) \??\Z: 2TXt7S.exe File opened (read-only) \??\L: 2TXt7S.exe File opened (read-only) \??\R: 2TXt7S.exe File opened (read-only) \??\S: 2TXt7S.exe File opened (read-only) \??\Y: 2TXt7S.exe File opened (read-only) \??\N: 2TXt7S.exe File opened (read-only) \??\I: 2TXt7S.exe File opened (read-only) \??\J: 2TXt7S.exe File opened (read-only) \??\K: 2TXt7S.exe File opened (read-only) \??\M: 2TXt7S.exe File opened (read-only) \??\P: 2TXt7S.exe File opened (read-only) \??\V: 2TXt7S.exe File opened (read-only) \??\W: 2TXt7S.exe File opened (read-only) \??\B: 2TXt7S.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-125.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-250.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png 2TXt7S.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 2TXt7S.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_contrast-high.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldThrow.snippets.ps1xml 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-150.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1CORE.DLL.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-125.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-180.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf 2TXt7S.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\17.rsrc 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sun.png 2TXt7S.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\5px.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxt 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SpherePixelShader.cso 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-400.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png 2TXt7S.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2TXt7S.exe File opened for modification C:\Program Files\BackupResolve.php.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-60_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.jpg 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms 2TXt7S.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52c45614dc40e0c491dc80d78fed39678
SHA1522b8e4d10f8fdb88924bd525f019308b802eacd
SHA25695c4c77332a9036fea9828dec779288a9716d2bc512b85d3cd11c47a0d8575f3
SHA512ca8552b544fde0c58ec5acf747f95883844bd3f28fbd73b519b4b4b40797d9c188f959c350a52118badc3bfc10b9db1d4e21ef25d3a65b3ac7cc8219624ed373