Resubmissions
12/06/2024, 22:11
240612-135j1asekc 1012/06/2024, 20:56
240612-zq6qvstekp 1028/05/2024, 13:15
240528-qg9aysfh38 1027/05/2024, 20:52
240527-zn2dcshf8x 10Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2TXt7S.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2TXt7S.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2TXt7S.exe
-
Size
326KB
-
MD5
21413e789eea9d581d047df32fad7fa7
-
SHA1
c361103da37aff0216281781dff09fa5c079864b
-
SHA256
7bc87a26137cc07cabf31e6e4bcd0e514846b5dd727a29132919f2e6b317cde8
-
SHA512
cd6bd0f43b0385a392395add3108134d8aeb62cea3ed470ddfeea66ac096cc6de5e85bc2dda3798a13437ae4b6c38580a3b2e24143db1835c88d268b2ec570c4
-
SSDEEP
6144:fXqpIW/yostkBUPSuLWT9Dj4IByRuE3AzJNxRGI20JE:/q2W/7+kBuqjKuE6NxAn0JE
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8491) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2TXt7S.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2TXt7S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files (x86)\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2TXt7S.exe File opened for modification C:\Users\Public\desktop.ini 2TXt7S.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 2TXt7S.exe File opened (read-only) \??\P: 2TXt7S.exe File opened (read-only) \??\Q: 2TXt7S.exe File opened (read-only) \??\S: 2TXt7S.exe File opened (read-only) \??\U: 2TXt7S.exe File opened (read-only) \??\V: 2TXt7S.exe File opened (read-only) \??\A: 2TXt7S.exe File opened (read-only) \??\E: 2TXt7S.exe File opened (read-only) \??\G: 2TXt7S.exe File opened (read-only) \??\J: 2TXt7S.exe File opened (read-only) \??\M: 2TXt7S.exe File opened (read-only) \??\O: 2TXt7S.exe File opened (read-only) \??\T: 2TXt7S.exe File opened (read-only) \??\Z: 2TXt7S.exe File opened (read-only) \??\I: 2TXt7S.exe File opened (read-only) \??\K: 2TXt7S.exe File opened (read-only) \??\X: 2TXt7S.exe File opened (read-only) \??\H: 2TXt7S.exe File opened (read-only) \??\L: 2TXt7S.exe File opened (read-only) \??\N: 2TXt7S.exe File opened (read-only) \??\R: 2TXt7S.exe File opened (read-only) \??\W: 2TXt7S.exe File opened (read-only) \??\Y: 2TXt7S.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Jamaica.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18206_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG.PLAY 2TXt7S.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\THMBNAIL.PNG 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01240_.GIF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PREVIEW.GIF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui 2TXt7S.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00095_.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui 2TXt7S.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 2TXt7S.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXC 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar 2TXt7S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Macau.PLAY 2TXt7S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ORG97R.SAM.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00810_.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21307_.GIF 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199755.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESPL.ICO.PLAY 2TXt7S.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107516.WMF 2TXt7S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00494_.WMF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF.PLAY 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui 2TXt7S.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg 2TXt7S.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 16888 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 16888 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe 16888 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2TXt7S.exe"C:\Users\Admin\AppData\Local\Temp\2TXt7S.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:2204
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:16888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51423efa2373ba4be0b2b368b91523460
SHA1b51605c0c264ffe53ec8da260d9b0b09c6b66f8f
SHA2566402c6a27e73a08d45d896fe8b1f9489385378b0fa07afa0bc9ef6b369a4b610
SHA5127a838a9ea0769ec9531c206c443c4f545ddbe6bb6787e117f7d853d6a87b1964ef8d7663d0b91c515df31f78b1c248b11df2ae1eed71d17506b6d34f29801ae7