Analysis
- max time kernel
150s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
13/03/2026, 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe
- Size 128KB
- Sample260313-dyscjsgt6z
- SHA256 d02b7c4180c7453bd2389a4b6370176de6bf3a96acc6522c9528f24d95bcad3a
- MD5 5ec17ee967083918a38b223b154b96a5
- SHA1 703ab5a0ce3d50ccfe6dfbdbf1e2f219cd4aa3a5
- SHA512 98c3b665f8c9be90074033cea9d973dc6b53d99fc991f5e746e3f261684a3263ad2d84a5d0b0cb0588e98cb208177ab16a5df768d63f63ac0d0355de645b25cd
- SSDEEP 3072:sCo+6DIwRCIfgxfsYJIKdG5vOVpa/guB7nGj65aZfdHtEY/zuh6y7:u+6DIwRNgOuQ5GVpInI6kzy77
- TLSH T123D32810B181D8F1E4B6047A56F586B9EE38BA3017019EEFB7D41E6A1F381D1A132E77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (2309) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2122505878-652277452-2375749442-1000\desktop.ini 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\N: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\R: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\X: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\K: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\S: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\Y: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\I: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\M: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\P: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\Q: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\W: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\Z: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\A: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\E: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\H: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\L: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\O: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\T: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\U: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\V: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\B: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened (read-only) \??\G: 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\th.txt 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\accessibility.properties 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419_NEUTER.pak 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nb_MASCULINE.pak 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\Office16\SLERROR.XML 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ur_FEMININE.pak 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it_NEUTER.pak 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sw_FEMININE.pak 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\cacerts 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CHART.DLL 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-13_5ec17ee967083918a38b223b154b96a5_amadey_elex_hellokitty_metamorfo_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2122505878-652277452-2375749442-1000\desktop.ini
- Size 1KB
- SHA256 1661ffc4beb0e4352a54efe966001d7360611e61b19e51d92ee0949e24663b55
- MD5 dc36dcdd5909a79ab4faed1ea042d71d
- SHA1 e267732e43954dd8d4d265bff0f2d850f56fae62
- SHA512 a2cfac5454a6f0d63b9ebc770b4537c6d7268afd6412f926f84e4d662d79bd2ef8c9da2cb0ac889760ce1f2b054f802a5fc30a6954dd9cb10ea3a36e5d4b8c62
- TLSH T1E121B75FC7B9247EE867D6B021201A7C0439749D2C49A94F5734F411A77A581E38A8B1
- MD5 SHA1 SHA512 TLSH