Analysis
- max time kernel
128s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2TXt7S.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2TXt7S.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2TXt7S.exe
- Size 326KB
- Sample240606-xmnprsbd78
- SHA256 7bc87a26137cc07cabf31e6e4bcd0e514846b5dd727a29132919f2e6b317cde8
- MD5 21413e789eea9d581d047df32fad7fa7
- SHA1 c361103da37aff0216281781dff09fa5c079864b
- SHA512 cd6bd0f43b0385a392395add3108134d8aeb62cea3ed470ddfeea66ac096cc6de5e85bc2dda3798a13437ae4b6c38580a3b2e24143db1835c88d268b2ec570c4
- SSDEEP 6144:fXqpIW/yostkBUPSuLWT9Dj4IByRuE3AzJNxRGI20JE:/q2W/7+kBuqjKuE6NxAn0JE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Renames multiple (7347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Admin\Contacts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2TXt7S.exe File opened for modification C:\Program Files (x86)\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2TXt7S.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 2TXt7S.exe File opened (read-only) \??\H: 2TXt7S.exe File opened (read-only) \??\I: 2TXt7S.exe File opened (read-only) \??\K: 2TXt7S.exe File opened (read-only) \??\V: 2TXt7S.exe File opened (read-only) \??\N: 2TXt7S.exe File opened (read-only) \??\U: 2TXt7S.exe File opened (read-only) \??\Z: 2TXt7S.exe File opened (read-only) \??\A: 2TXt7S.exe File opened (read-only) \??\E: 2TXt7S.exe File opened (read-only) \??\L: 2TXt7S.exe File opened (read-only) \??\Y: 2TXt7S.exe File opened (read-only) \??\S: 2TXt7S.exe File opened (read-only) \??\G: 2TXt7S.exe File opened (read-only) \??\J: 2TXt7S.exe File opened (read-only) \??\M: 2TXt7S.exe File opened (read-only) \??\O: 2TXt7S.exe File opened (read-only) \??\P: 2TXt7S.exe File opened (read-only) \??\Q: 2TXt7S.exe File opened (read-only) \??\R: 2TXt7S.exe File opened (read-only) \??\T: 2TXt7S.exe File opened (read-only) \??\W: 2TXt7S.exe File opened (read-only) \??\X: 2TXt7S.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.strings.psd1 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_altform-unplated_contrast-white.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PREVIEW.GIF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-60_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-200_contrast-white.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses.svg 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\adovbs.inc 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.ELM 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\39.jpg 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-540404634-651139247-2967210625-1000-MergedResources-0.pri 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\3DViewerProductDescription-universal.xml 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-fullcolor.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\ExcelCapabilities.json.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-40.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-60_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2TXt7S.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-400.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7db.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.PLAY 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.PLAY 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_MedTile.scale-200.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-125.png 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Mozilla Firefox\locale.ini.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24_altform-unplated.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W7.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\160.png 2TXt7S.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\networkmanifest.xml 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\ui-strings.js 2TXt7S.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini
- Size 1KB
- SHA256 02905641a84e3b2990d64fc7c801d334cc9c5aefea87fd0228382e1b72b59f73
- MD5 b05abf0a3b769e4d83d6401c060b2a04
- SHA1 4e2c4920119a55699d8a7688763c9890283c6840
- SHA512 2ff586090fe01b5073506c59efa92ff223087d94c6435d04906f18423fa8c9535157c38d677f83be4d88294bb6a48a538b09fd32f5f8d6b191f8c932336a3623
- MD5 SHA1 SHA512