Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 01:44
Behavioral task
behavioral1
Sample
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
-
Size
178KB
-
MD5
4519a5876b3e77568105da0f1c2ebb4d
-
SHA1
78823aed1ec75b00214dccd654f5ea5dd38cfd58
-
SHA256
bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7
-
SHA512
f4a106b983a3c330983a6bce311cff54241c9a9b7aac31116a1ee0ebca9f20126d9e584f4b6b8fbbd3498fbb4632d1fe6373e08fd7dc3f0819fe9ebd8d9c69f9
-
SSDEEP
3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (8560) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Videos\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Music\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Links\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Music\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Users\Public\Documents\desktop.ini bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\T: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\W: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\L: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\N: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\J: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\O: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\R: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\U: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\X: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\Y: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\B: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\H: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\G: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\I: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\K: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\P: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\Z: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\A: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\E: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\V: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\M: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened (read-only) \??\S: bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\bg.txt bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188513.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00486_.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10264_.GIF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\HST.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcfr.dll.mui bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0280468.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.ELM.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01242_.GIF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLR.SAM bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\micaut.dll.mui bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\QUAD.INF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21297_.GIF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\RestartMerge.easmx bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0168644.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMSXP32.DLL bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXT bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00052_.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcor.dll.mui bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301252.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.ELM.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN026.XML bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187815.WMF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_COL.HXC bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF.PLAY bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\PREVIEW.GIF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\STSUCRES.DLL bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe"C:\Users\Admin\AppData\Local\Temp\bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c3a661aa11d8fef8a26586f9205bb0c
SHA127041fcd10468e36177174608e562f5914dbfa38
SHA2562779cfab0d6791095f2627af0e9fdd03a9d384b88e40dc11b17fd563a165d0f9
SHA5129c681e0af9df9f2e35cf42500be64c4332e9e033aa6144ce98928249512575344723da01ba152b85888f7a081abe220f6fa9d52d416453418df3a4b7c29013ac