Resubmissions

25-07-2024 14:12

240725-rh7dessgkl 10

07-07-2024 09:11

240707-k5yaps1bpa 10

Analysis

  • max time kernel
    87s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 14:12

General

  • Target

    f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe

  • Size

    326KB

  • MD5

    f088b0524afae3a92f571c4cc390d064

  • SHA1

    4945a0a0f226aac22992e4960d1f764904c509d2

  • SHA256

    f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402

  • SHA512

    b41b13f7c3b8679371f1effbdb0f64e9466a549cda4116e058f18892e0883819fa797ac57c1eaad56db4f71dee39fa3ff107d12d656c40005813b1621820057e

  • SSDEEP

    6144:QXqpIW/yoztkBUPeuLWzWDj4IByRuE3AzJNxRbIIJE:qq2W/7RkB6qGKuE6NxBIIJE

Malware Config

Signatures

  • PLAY Ransomware, PlayCrypt

    Ransomware family first seen in mid 2022.

  • Renames multiple (6112) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe
    "C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini

    Filesize

    1KB

    MD5

    6cdb037256a20edea95bae5859043786

    SHA1

    a596c1c19508db27e1da02bb932adfd7487046ba

    SHA256

    33237073d15be41104efa2550694144b66703c3119e5e6435c069b9b29c4169f

    SHA512

    a03d8898195b52a95423ed00e358c9343cc02ddb6efc383fd88e119e9adbad23f055006845cce754b6371a1e4c8aa1cba6eca7483535ee25e972822fb0d2ef6c

  • C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini

    Filesize

    1KB

    MD5

    ef0eec446447b37d3ce8751ea382c0ef

    SHA1

    f3839be97a89597c659c9a23ec9c78c2cd08952b

    SHA256

    08bd410e96f09943c2a469cd5c27d444183539f6447fdae8f1327d5221817850

    SHA512

    31c3dea571295c9b52d1df631123ffcefc5d0d03fbfb94c61265eb440a06355df7187463b5dcb3861cb335adc393c662fdced8630aaa1d3fdaef16be747eec7e

  • memory/3940-0-0x0000000002310000-0x000000000233C000-memory.dmp

    Filesize

    176KB