Analysis
-
max time kernel
127s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 12:31
Behavioral task
behavioral1
Sample
2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe
-
Size
178KB
-
MD5
4519a5876b3e77568105da0f1c2ebb4d
-
SHA1
78823aed1ec75b00214dccd654f5ea5dd38cfd58
-
SHA256
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7
-
SHA512
f4a106b983a3c330983a6bce311cff54241c9a9b7aac31116a1ee0ebca9f20126d9e584f4b6b8fbbd3498fbb4632d1fe6373e08fd7dc3f0819fe9ebd8d9c69f9
-
SSDEEP
3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (7476) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\S: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\W: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\B: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\H: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\K: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\G: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\L: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\N: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\R: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\U: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\X: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\E: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\I: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\J: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\P: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\T: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\V: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\Y: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\Z: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\A: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\M: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened (read-only) \??\O: 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-black_scale-125.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\CamMDL2.2.07.ttf 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionPage.xbf 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.scale-200_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-high.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextDark.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-200.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\SmallTile.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\YelpLogo.svg 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30_altform-unplated.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-200.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-125.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-150_contrast-white.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-36_altform-unplated.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\7-Zip\readme.txt.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_EN.LEX.PLAY 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\WideTile.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\THMBNAIL.PNG 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\font\CameraSymbols.ttf 2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-27_4519a5876b3e77568105da0f1c2ebb4d_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4648,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5417df5e7b38bfc85a02af9a3d82a3d7b
SHA10525ac061578213b8f43b50e0180ef12d8fc6609
SHA2567d06ad77fb4108b7babff25fcdcb835b45e34c4f6e05ccb896080d566e245887
SHA51252dd07862335ddd88d88a12da6092651c83a8ccdb749c1ece125d239b07f47035421007212008e4cce5e47a84fe401a8538af63081bbcb6f47b9e9b88743933b