play | bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7

Analysis

max time kernel
78s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/11/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
Size

178KB
MD5

4519a5876b3e77568105da0f1c2ebb4d
SHA1

78823aed1ec75b00214dccd654f5ea5dd38cfd58
SHA256

bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7
SHA512

f4a106b983a3c330983a6bce311cff54241c9a9b7aac31116a1ee0ebca9f20126d9e584f4b6b8fbbd3498fbb4632d1fe6373e08fd7dc3f0819fe9ebd8d9c69f9
SSDEEP

3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17

Score

10^/10

play ransomware

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play
Play family
play
Renames multiple (2291) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\desktop.ini	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\H:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\O:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\P:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\R:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\X:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\I:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\K:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\S:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\U:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\Y:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\J:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\M:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\V:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\W:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\Z:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\A:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\B:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\E:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\L:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\N:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\Q:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened (read-only)	\??\T:	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Panama	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Chicago	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\psfontj2d.properties	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\ImportExit.wvx	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Martinique	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF	bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe

C:\Users\Admin\AppData\Local\Temp\bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe
"C:\Users\Admin\AppData\Local\Temp\bc381dbeff70b5869fa737860c8cd8a8684cc768981beb55543499efcd32bab7.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini

Filesize
1KB

MD5
56695d5e728944d030b3573482a88f27

SHA1
d0ac758985758b4c2154788cff8aa4aface5e6ef

SHA256
12be9eea0dcb6f1e42f677d1ae58c954ae982929f79cf8956904b33c5ebcc8a4

SHA512
7e1f956d1d16fa7bf5337b7fda326557322f9473a852121f984caca45f6c4746e5744f1e5bb9cdfc7ba17e740413d8d912d26e3a81fa8c07d284f4a4330449b4

Download Submit
memory/2072-0-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download