Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 02:16
Behavioral task
behavioral1
Sample
play_2.bin.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
play_2.bin.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
play_2.bin.exe
-
Size
178KB
-
MD5
4519a5876b3e77568105da0f1c2ebb4d
-
SHA1
78823aed1ec75b00214dccd654f5ea5dd38cfd58
-
SHA256
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7
-
SHA512
f4a106b983a3c330983a6bce311cff54241c9a9b7aac31116a1ee0ebca9f20126d9e584f4b6b8fbbd3498fbb4632d1fe6373e08fd7dc3f0819fe9ebd8d9c69f9
-
SSDEEP
3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8502) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini play_2.bin.exe File opened for modification C:\Program Files\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI play_2.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini play_2.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini play_2.bin.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini play_2.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini play_2.bin.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini play_2.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini play_2.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini play_2.bin.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: play_2.bin.exe File opened (read-only) \??\N: play_2.bin.exe File opened (read-only) \??\P: play_2.bin.exe File opened (read-only) \??\Q: play_2.bin.exe File opened (read-only) \??\V: play_2.bin.exe File opened (read-only) \??\B: play_2.bin.exe File opened (read-only) \??\J: play_2.bin.exe File opened (read-only) \??\K: play_2.bin.exe File opened (read-only) \??\O: play_2.bin.exe File opened (read-only) \??\R: play_2.bin.exe File opened (read-only) \??\T: play_2.bin.exe File opened (read-only) \??\U: play_2.bin.exe File opened (read-only) \??\Y: play_2.bin.exe File opened (read-only) \??\G: play_2.bin.exe File opened (read-only) \??\L: play_2.bin.exe File opened (read-only) \??\M: play_2.bin.exe File opened (read-only) \??\S: play_2.bin.exe File opened (read-only) \??\W: play_2.bin.exe File opened (read-only) \??\I: play_2.bin.exe File opened (read-only) \??\E: play_2.bin.exe File opened (read-only) \??\X: play_2.bin.exe File opened (read-only) \??\Z: play_2.bin.exe File opened (read-only) \??\A: play_2.bin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar play_2.bin.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.PLAY play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02296_.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS play_2.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png play_2.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api play_2.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSO.DLL play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar play_2.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML play_2.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos play_2.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\ARCTIC.INF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00034_.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL play_2.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png play_2.bin.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcer.dll.mui play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF play_2.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01394_.WMF play_2.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar play_2.bin.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcor.dll.mui play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSCLT.DLL play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\PublicFunctions.js play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QP.XML play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Maroon.css play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSWORD.OLB play_2.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar play_2.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html play_2.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG play_2.bin.exe File opened for modification C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui play_2.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.ICO play_2.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png play_2.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf play_2.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.PLAY play_2.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png play_2.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151063.WMF play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeLetter.Dotx play_2.bin.exe File opened for modification C:\Program Files\GetExpand.mp4.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.PLAY play_2.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml play_2.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_de.properties play_2.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL020.XML play_2.bin.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d61b1dadcd3d80eaa9cedad10634b77c
SHA180f267dbde77c315ed1a7db6c7cff8be2dfe9f99
SHA2569eeb75e4a87d86946d3f0d8536480fa30fa9d98eefd82eaa5e19377183ff5678
SHA51244bd4e7be6f045fee4f00a8c1963e4f7c5294cf06a29847ca38cb97c42f778fee3660345357e31b8f781f106910996eb02b2eb4309c9cb9083f97c881a27703c