Malware Analysis Report

2024-10-18 21:37

Sample ID 240725-rm76hstakl
Target 4d3d315c87af193af02eb5489fa7228b9ecc3aef75464325acc38a9a8c232b02
SHA256 4d3d315c87af193af02eb5489fa7228b9ecc3aef75464325acc38a9a8c232b02
Tags
play ransomware credential_access discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d3d315c87af193af02eb5489fa7228b9ecc3aef75464325acc38a9a8c232b02

Threat Level: Known bad

The file 4d3d315c87af193af02eb5489fa7228b9ecc3aef75464325acc38a9a8c232b02 was found to be: Known bad.

Malicious Activity Summary

play ransomware credential_access discovery spyware stealer

PLAY Ransomware, PlayCrypt

Credentials from Password Stores: Credentials from Web Browsers

Renames multiple (7411) files with added filename extension

Renames multiple (7550) files with added filename extension

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in Program Files directory

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 14:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 14:19

Reported

2024-07-25 14:22

Platform

win7-20240704-en

Max time kernel

77s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"

Signatures

PLAY Ransomware, PlayCrypt

ransomware play

Renames multiple (7550) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado25.tlb C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107450.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Panama C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVHM.POC C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yellowknife C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241043.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\handler.reg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152626.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02223U.BMP C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.DLL C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\44.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN097.XML C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMSXP32.DLL C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe

"C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"

Network

N/A

Files

memory/2332-0-0x0000000000270000-0x000000000029C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini

MD5 24f7b2170653e1fa8926cf632aeb0db8
SHA1 80c74db88a43c8bb95bb9ef43f0011229532917a
SHA256 1e316b3fc1cb34d32616bed3a591c3a4acfe93956c1fed9b829797b5a9e041cb
SHA512 23f58b851359677f43b97a41cda3c51f2c7972e44bfdc02fe896445fd33805e1ef033126e59a873939dae74f325959771e9f2be94cb8b624e95c3834fe92d6a4

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 14:19

Reported

2024-07-25 14:22

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"

Signatures

PLAY Ransomware, PlayCrypt

ransomware play

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Renames multiple (7411) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-125.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\BadgeLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-1x.png.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxSelected.svg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.ELM.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxAccountsSplashLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_contrast-white.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_06.jpg C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Fonts\MapsMDL2.2.34.ttf C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.ELM.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\FM20.CHM C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt.PLAY C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Wood.dxt C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-400.png C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe

"C:\Users\Admin\AppData\Local\Temp\dcaf62ee4637397b2aaa73dbe41cfb514c71565f1d4770944c9b678cd2545087.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2660 -ip 2660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 39116

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

memory/2660-0-0x0000000002930000-0x000000000295C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini

MD5 e3f04f0b668be8965412530211d326a4
SHA1 ce92e564e633bd578969c0b820dc55066e9df684
SHA256 a28032644e2c93368fd3cd7a0ae9934d50f1fd120ca52e8a5fb9d3983c12ee76
SHA512 9b133b81c782d3cd327019a4fbb8c6f405d846d72263a8f4170b244355f8d83ac55933f395608499e3d8d483ba7b42f29a72361c93ff8140fac5bbbc818c7d04