Analysis
-
max time kernel
35s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe
-
Size
110KB
-
MD5
addafbaa977dde4a5207b3abc3caf24c
-
SHA1
9df19b7170ecab89f87ba22f2700e5534eda297b
-
SHA256
dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087
-
SHA512
f0777595040f4c50abd8db0943f1728b145bee1bdbec58ab2040d7dae8677479b0ecaccf0a7ab311b9374ccd128148d1ae6c20cb7fec2f28ff4f7049b2212f9e
-
SSDEEP
3072:aagoUqGqGRdi2RcKKmLgGFuCp+8rWgGbmOGgkF9x+vUABeZhaj:fCZPnFj+2OC+07K
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (2463) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1340930862-1405011213-2821322012-1000\desktop.ini dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\desktop.ini dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\U: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\Y: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\B: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\G: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\M: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\L: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\O: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\Z: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\I: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\Q: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\W: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\J: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\K: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\N: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\P: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\R: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\A: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\E: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\H: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\S: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\V: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened (read-only) \??\X: dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Asuncion dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5 dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\security\local_policy.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MET dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\flavormap.properties dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:1208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b2db9caad8ece44e57a8378a2f78be2e
SHA1e37cb20c4ebda0a92feb9293a2965073d761c9d4
SHA256182a12353e93b638a47afae9cb42970b6c6dd0fc76ea896c38d2e05c81de84cd
SHA512f98a0afe3a8bcf3fe6d0c5abfc65b87ef2ecded43558706e0351b82863c7c1cf646576e3b76ba36eac41f47f09870d6cc4371d98493259196f6378745a39b4c6