play | a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec

Resubmissions

12/02/2025, 11:40

250212-ns8gpazldx 10

12/02/2025, 03:44

250212-eaz8xsykfv 10

11/02/2025, 22:45

250211-2pks4stnfm 10

Analysis

max time kernel
120s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2025, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
Size

481KB
MD5

75367b27129a302e5ef5930a2c9699c0
SHA1

73c3e68f1c25a4071e8bd035486d2445bbcb2aa7
SHA256

a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec
SHA512

8d4195ff8174cbae829723452bd6f1f78c9b00a28a041d8e346d4c45dac1a0956467f68ce3083761d801d707a782b89d0832213ded2ddf432ba15ab2e0bcf78c
SSDEEP

6144:anGGn1wd4WWkSFyzAAe8zCgJkihWjduuNacDK8TOIwn5PKNuxK9u1Ot6u:QGGJWWT8zxho7WiPw5P0uiC86u

Score

10^/10

play discovery ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play
Play family
play
Renames multiple (7320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 29 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3296967594-3563063956-581523229-1000\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\Z:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\A:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\E:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\L:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\O:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\Q:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\S:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\T:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\I:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\J:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\K:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\M:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\U:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\V:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\X:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\G:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\H:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\N:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\R:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\B:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\P:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened (read-only)	\??\W:	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Wide.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-125.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\THMBNAIL.PNG	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-125.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\SkypeAssets-Medium.ttf	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-96.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\91.jpg	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\resources.pri	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WideTile.scale-100.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\plugin.js	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-200.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.ps1	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-36_altform-unplated.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\3.jpg	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main-selector.css	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSPTLS.DLL.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\MatchExactly.ps1	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\PREVIEW.GIF.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Wide.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-100.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.PLAY	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-150.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.schema.mfl	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-black.png	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe

C:\Users\Admin\AppData\Local\Temp\a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe
"C:\Users\Admin\AppData\Local\Temp\a782b9d82f21fb3aac32de6d24a8730eb39f1bd34bc590ca03fa6bb527c74fec.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3296967594-3563063956-581523229-1000\desktop.ini

Filesize
1KB

MD5
d23a2d98d34541bef4d82e3cac8253c6

SHA1
311c7813864defecc8d9e8a13f71b7f6249f40c7

SHA256
6c5c77e13149ed769dd0009609d938edf6fa278562de82705a042828a6c7a939

SHA512
699bc5b67e8cd0570db0b29926889406976568a1cf24b39e7b86d3b234b1d85452cad4912accb6c6dba1fc911dd160e3707df7983977fbf9508bb1bbd0650d3f

Download Submit
C:\$Recycle.Bin\S-1-5-21-3296967594-3563063956-581523229-1000\desktop.ini

Filesize
1KB

MD5
3f88e15cf189abbe2a50c7b804cf9720

SHA1
5324d25eaa39a64f98ffc53bed2465575e4bcc09

SHA256
0e0a6aa73f0733450f2237206af20efe7430ec5a2fac3ae45f700910c7c333df

SHA512
20e52e5b5038e5681d89394da21ffd5d303a4c3fe69e306e6bd5e0aa090c36119e72b9e28389366c485a4499a1c67edc683f6b8b1f47064573af0f7eaef92457

Download Submit
memory/3288-0-0x0000000000D70000-0x0000000000D9C000-memory.dmp

Filesize
176KB

Download