Play

How Play typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Play, Playcrypt.

1. T1587.001 Malware Resource Development

   What they do: Play developed and employ Playcrypt ransomware.

   What that means: Adversaries may develop malware and malware components that can be used during targeting.

2. T1588.002 Tool Resource Development

   What they do: Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.

   What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.

3. T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: Play has used valid VPN accounts to achieve initial access.

   What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

4. T1078.002 Domain Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: Play has used valid domain accounts for access.

   What that means: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

5. T1078.003 Local Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: Play has used valid local accounts to gain initial access.

   What that means: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

6. T1133 External Remote Services Initial AccessPersistence

   What they do: Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.

   What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

7. T1190 Exploit Public-Facing Application Initial Access

   What they do: Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.

   What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

8. T1059.001 PowerShell Execution

   What they do: Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

9. T1059.003 Windows Command Shell Execution

   What they do: Play has used a batch script to remove indicators of its presence on compromised hosts.

   What that means: Adversaries may abuse the Windows command shell for execution.

10. T1027.010 Command Obfuscation Stealth

    What they do: Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

    What that means: Adversaries may obfuscate content during command execution to impede detection.

11. T1070.004 File Deletion Stealth

    What they do: Play has used tools including Wevtutil to remove malicious files from compromised hosts.

    What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

12. T1685 Disable or Modify Tools Defense Impairment

    What they do: Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

13. T1685.005 Clear Windows Event Logs Defense Impairment

    What they do: Play has used tools to remove log files on targeted systems.

    What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

14. T1003.001 LSASS Memory Credential Access

    What they do: Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.

    What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

15. T1016 System Network Configuration Discovery Discovery

    What they do: Play has used the information-stealing tool Grixba to enumerate network information.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

16. T1018 Remote System Discovery Discovery

    What they do: Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

17. T1057 Process Discovery Discovery

    What they do: Play has used the information stealer Grixba to check for a list of security processes.

    What that means: Adversaries may attempt to get information about running processes on a system.

18. T1082 System Information Discovery Discovery

    What they do: Play has leveraged tools to enumerate system information.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

19. T1083 File and Directory Discovery Discovery

    What they do: Play has used the Grixba information stealer to list security files and processes.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

20. T1518.001 Security Software Discovery Discovery

    What they do: Play has used the information-stealing tool Grixba to scan for anti-virus software.

    What that means: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

21. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: Play has used Cobalt Strike to move laterally via SMB.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

22. T1560.001 Archive via Utility Collection

    What they do: Play has used WinRAR to compress files prior to exfiltration.

    What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

23. T1105 Ingress Tool Transfer Command and Control

    What they do: Play has used Cobalt Strike to download files to compromised machines.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.

24. T1030 Data Transfer Size Limits Exfiltration

    What they do: Play has split victims' files into chunks for exfiltration.

    What that means: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

25. T1048 Exfiltration Over Alternative Protocol Exfiltration

    What they do: Play has used WinSCP to exfiltrate data to actor-controlled accounts.

    What that means: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

26. T1486 Data Encrypted for Impact Impact

    What they do: Playcrypt encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

27. T1490 Inhibit System Recovery Impact

    What they do: Playcrypt can use AlphaVSS to delete shadow copies.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

28. T1657 Financial Theft Impact

    What they do: Play demands ransom payments from victims to unencrypt filesystems and to not publish sensitive data exfiltrated from victim networks.

    What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Software Play has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.

The note this group leaves on a compromised machine. Click a filename to read it.

Your network has been encrypted. Your private, personal, corporate, confidential data has been stolen.
If you do not resolve the issue, your data will be published on our leak portal.
News portal, tor network links: 
ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion
j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion
contact email: [email protected]
PLAY Ransomware Team

PLAY
news portal, tor network links:
mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
[email protected]

PLAY
[email protected]

Ransom-note text from RansomLook, licensed CC BY 4.0.