Malware Analysis Report

2024-10-18 21:36

Sample ID 240725-rh7dessgkl
Target f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402
SHA256 f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402
Tags
play credential_access discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402

Threat Level: Known bad

The file f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402 was found to be: Known bad.

Malicious Activity Summary

play credential_access discovery ransomware spyware stealer

PLAY Ransomware, PlayCrypt

Credentials from Password Stores: Credentials from Web Browsers

Renames multiple (8537) files with added filename extension

Renames multiple (6112) files with added filename extension

Reads user/profile data of web browsers

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in Program Files directory

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 14:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 14:12

Reported

2024-07-25 14:15

Platform

win7-20240705-en

Max time kernel

149s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe"

Signatures

PLAY Ransomware, PlayCrypt

ransomware play

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Renames multiple (8537) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Flow.eftx C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WZCNFLCT.CHM C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN090.XML C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV.HXS C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOCIALPROVIDER.DLL C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Austin.eftx C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00423_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02388_.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieLetter.dotx C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Mail\en-US\msoeres.dll.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.PLAY C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Browser Information Discovery

discovery

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe

"C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4e8

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\ReadMe.txt

Network

N/A

Files

memory/828-0-0x00000000001D0000-0x00000000001FC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini

MD5 4cf9bc0ed4f82f99f7df0e4d4728fff8
SHA1 77a3e8c08f966d1b8e5042735fd86b9cfc54a436
SHA256 dd52f06d19ae946aeb32562c1f11d9a07ca9b77475d1a0b2c5834cbd096b4862
SHA512 c5b7dfb9031014e7cc9397c886570f1b6950f510281e1fc2dbccd94666b0b93ff8c0115c3f83c5c165bd61fa5823e4a3d33dde62ee6a25719d91527a1b865a05

C:\ReadMe.txt

MD5 c6d16a305a09f08f3d2d43f44a524dc4
SHA1 60478c2a5497734499a8455b5022845a6f6d4049
SHA256 95df1ea5b53097e45e438c61fc2e5d081ca5784271edb17ee8a4cf863e79797d
SHA512 e6d71e52e2d614b210e3c1acd5f379e45f9f233c1201835d1e10a3719b4be242f937f52426f3ef54f0744ac531a3384e1617058d521999e7ed5afa834083d67f

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 14:12

Reported

2024-07-25 14:15

Platform

win10v2004-20240709-en

Max time kernel

87s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe"

Signatures

PLAY Ransomware, PlayCrypt

ransomware play

Renames multiple (6112) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-250.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\dropdownarrow_16x16x32.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-125.HCWhite.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.strings.psd1 C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppWord32x32.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\offlineUtilities.js C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VBAOWS10.CHM C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Zview.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsyml.ttf C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-down_32.svg C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-125.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.Native.winmd C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-40.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\profilePic.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\bell_empty.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AIRWER.DLL C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\EDGE.ELM C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe

"C:\Users\Admin\AppData\Local\Temp\f741b66592c42e73af7adc46815cf6183765a2fb6a5f9f96cc75eaaf7dc15402.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/3940-0-0x0000000002310000-0x000000000233C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini

MD5 6cdb037256a20edea95bae5859043786
SHA1 a596c1c19508db27e1da02bb932adfd7487046ba
SHA256 33237073d15be41104efa2550694144b66703c3119e5e6435c069b9b29c4169f
SHA512 a03d8898195b52a95423ed00e358c9343cc02ddb6efc383fd88e119e9adbad23f055006845cce754b6371a1e4c8aa1cba6eca7483535ee25e972822fb0d2ef6c

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini

MD5 ef0eec446447b37d3ce8751ea382c0ef
SHA1 f3839be97a89597c659c9a23ec9c78c2cd08952b
SHA256 08bd410e96f09943c2a469cd5c27d444183539f6447fdae8f1327d5221817850
SHA512 31c3dea571295c9b52d1df631123ffcefc5d0d03fbfb94c61265eb440a06355df7187463b5dcb3861cb335adc393c662fdced8630aaa1d3fdaef16be747eec7e