Analysis
-
max time kernel
67s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe
-
Size
481KB
-
MD5
3039e3c5a73f506446882271569da699
-
SHA1
fe6c2d80fe6e20e23ffd5c36116b31b0c33ab926
-
SHA256
cdb54fee4c049cfd0bd09206414e1c8bd5ec5cbab7e7fff30b2c8ae90796439e
-
SHA512
7e95e5eefe9a3cf538eaa5adc4f454366d887ffcdb20ed5145731a77f0a12ccd07be67e7a90205230065c793d917c0c96e0abc68f22db2fc31467c53ede1a0a8
-
SSDEEP
6144:cn2GnFwd6CWwR802pdHMzqIxkFBtL12sFekDKUTP7ondtxvyaeZSNGilD6uH:O2G3CWlMz2BFnWqTodrvPeCRF6uH
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Play family
-
Renames multiple (3669) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\H: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\L: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\M: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\U: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\V: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\W: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\A: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\I: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\K: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\R: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\E: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\G: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\N: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\O: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\P: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\T: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\Y: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\J: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\Q: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\S: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\X: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened (read-only) \??\Z: 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ca.pak 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\cacerts 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.INF 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\7-Zip\History.txt 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\osmmui.msi.16.en-us.vreg.dat 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jvm.lib 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\THMBNAIL.PNG 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 53388 NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe"C:\Users\Admin\AppData\Local\Temp\38775537030769180f53c8a9070de02086dcf762eea17d3f086d761a0c3f858a.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3220
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\ReadMe.txt1⤵
- Opens file in notepad (likely ransom note)
PID:53388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ea10266fdc2a57da0b59b0a7796f29d6
SHA1d7778f8dc7241dd1d38df6837a19fa4313c06e8f
SHA2569317d2b338ff0f5b8f5cbd6f2132689c261f99630fdaf7113d936a211f91d88b
SHA5125c446f354057d8606c38c18f04646560536f3fdd00e622ee9fb51ee70e9959c6c83ef610510344aa17fac0bfc3f437d3b1992cdb12e70afd45bf948b41b605aa
-
Filesize
406B
MD54eae841c940cfb5a1abeb3d82fcea027
SHA18e0ec2a84e287e8037ed78807c8eac348839bdd3
SHA25628cfa631da7ca873558ce3b5d05dbd54d27d1bc06d6ad0b3cd392ab3f3f7eac3
SHA512c50015f02405b7cd5dc37496d7c71b40a5cb61a7418ea96e13d9d32a2b7a8d56d1095e8f128e73dbe8ffe7358451cb01cfc9e261539db24b9635a37120bb8e59