Analysis
- max time kernel
144s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/03/2026, 04:31
Behavioral task
behavioral1
Sample
2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe
- Size 178KB
- Sample260311-e5tdvsev3v
- SHA256 f3bf00f492837a94d2ec90e23d6acaed1442b2d9acbfe64609691d1c3dd8f4e7
- MD5 99e2ca765303437f8f672e6cecc7b561
- SHA1 04158d7a947b687eba0e1f54a2dbc6dc658bb8ce
- SHA512 bbd004ccf209f5ded96d5b03d399aaed8a352a8fd772cd55fce31d4b1b669db2d0e65b596f5605534f8ae424b55b51502198db9912c1f367cf07f3e810e810a6
- SSDEEP 3072:4jtpykdQOeDkhqikutBYYuoIqjAmGkXNmLxGF/tJr95/fhKJ2ih5cuG:IpH2rEg6Sk9m6tVzEP4
- TLSH T120047D05A7B2D0BAE477043865E99FF5CE2C39350B0148EB6788177969349E2E139F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7963) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Music\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-650218026-1419908266-2856590055-1000\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\P: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\Q: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\R: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\S: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\V: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\Z: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\H: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\J: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\K: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\L: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\O: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\B: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\M: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\T: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\U: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\W: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\X: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\E: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\G: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\I: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\Y: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened (read-only) \??\A: 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ct.sym 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Breadcrumb\index.js 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-24_altform-unplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-400.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-150.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-72_altform-lightunplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa.pak 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr_FEMININE.pak 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-36_altform-unplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSplashScreen.scale-250.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\styled.js 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ui-strings.js 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.schema.mfl 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-24.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48_altform-unplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MapsWideTile.scale-125.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-125.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\temporary_multiselect_24.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-60.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-256.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-lightunplated_contrast-white.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare71x71Logo.scale-100.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-48_altform-unplated.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-96_altform-unplated_contrast-black.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.3e53a08d.pri 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-200_contrast-black.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\TXP_Flight.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\ui-strings.js 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl.PLAY 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-11_99e2ca765303437f8f672e6cecc7b561_amadey_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4968
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-650218026-1419908266-2856590055-1000\desktop.ini
- Size 1KB
- SHA256 0a1c7bcb508c6e6ddd8c928b38af735f56181be538f0b40ea09e3eb9d6932028
- MD5 3801f46815edc724aca32c97a90f8bf2
- SHA1 a9d023a511b21f1138e819adcc4bc760aa4b0563
- SHA512 9c92e458ecc22e2cda10a97920caea34e9a0c2010fc708c30b36855c95f648cc8700f1dd159f85a7fd4c3d421ca585c739381648dc8181bb90bb84a9df93f06a
- TLSH T15821B7CF4CDE26176720697DACCAD151E962515DEC8C0786B588161B031802591CA94D
- MD5 SHA1 SHA512 TLSH
- Path C:\ReadMe.txt
- Size 28B
- SHA256 9c2f05d4e7e2bc4ab9decafd3acb2b473d51e9b26460e3d7494141cee264b3ad
- MD5 831e69e3e07b558074358adfdce44ab2
- SHA1 fdd8607c0191c9d6a19545ad9920d8d242170d22
- SHA512 8a9de7e1ecb5582e28ae2d9fda5435440994b602f71e59fe3e25e244d86355c5ce4db087c2703244f1a780f65ff83d75c9cd086999c348760b04352368872798
- MD5 SHA1 SHA512