Overview

overview

10

Static

static

3

dcaf62ee46...87.exe

windows7-x64

10

dcaf62ee46...87.exe

windows10-2004-x64

10

Resubmissions

25/07/2024, 14:13

240725-rjwy3ssgnl 10

25/06/2024, 17:30

240625-v25wgswcjj 10

Analysis

  • max time kernel
    111s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 14:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe

  • Size

    110KB

  • MD5

    addafbaa977dde4a5207b3abc3caf24c

  • SHA1

    9df19b7170ecab89f87ba22f2700e5534eda297b

  • SHA256

    dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087

  • SHA512

    f0777595040f4c50abd8db0943f1728b145bee1bdbec58ab2040d7dae8677479b0ecaccf0a7ab311b9374ccd128148d1ae6c20cb7fec2f28ff4f7049b2212f9e

  • SSDEEP

    3072:aagoUqGqGRdi2RcKKmLgGFuCp+8rWgGbmOGgkF9x+vUABeZhaj:fCZPnFj+2OC+07K

Score
10/10
playcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • PLAY Ransomware, PlayCrypt

    Ransomware family first seen in mid 2022.

    ransomwareplay
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Renames multiple (8488) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 39 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe
    "C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1256
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1048
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\ReadMe.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:5800
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:34032
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1524A5A420A0DCA14E51B27122CFD7AD
        2⤵
        • System Location Discovery: System Language Discovery
        PID:39460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini
      Filesize

      1KB

      MD5

      41f0fa27eaac7cda963571acee935f7a

      SHA1

      0637d30871d08df763d2838666cfab59778266a3

      SHA256

      a8888cf81062d3770d2888c83541ff243b6778c08daee254c6da80aa6a50b53a

      SHA512

      926cb897423a9ac296c70bef97db9f367b9f1974bb226fc0058b37c1f3fc1d6cead4a708ad021199af0ff611c8f35182ed2b5fade0fab75d17611be4285a1902

      Download Submit

    • C:\ReadMe.txt
      Filesize

      28B

      MD5

      16f93ef919291be05531f0b028c4b32a

      SHA1

      3d2df3342389bde385feebae59665e71b7a1dfd1

      SHA256

      7f1c1cd11c6c32293dfcabc05fec13a52770676b524c96525120fef03085b2e2

      SHA512

      fe0b0765de454d66b2b87e216839178d9df57cbf4573e61497042936330b9d90cf207798a9bfbcc9be5d6588c0b4253663734a15495fd2beffa54cddbd5c59c1

      Download Submit

    • C:\Windows\Installer\MSI7C62.tmp
      Filesize

      363KB

      MD5

      4a843a97ae51c310b573a02ffd2a0e8e

      SHA1

      063fa914ccb07249123c0d5f4595935487635b20

      SHA256

      727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

      SHA512

      905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

      Download Submit

    • \Windows\Installer\MSI4441.tmp
      Filesize

      257KB

      MD5

      d1f5ce6b23351677e54a245f46a9f8d2

      SHA1

      0d5c6749401248284767f16df92b726e727718ca

      SHA256

      57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

      SHA512

      960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

      Download Submit

    • memory/1256-0-0x0000000000360000-0x000000000038C000-memory.dmp

      Filesize

      176KB

      Download