73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 11:13

Target

73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
Size

326KB
MD5

f8533019841821eabdaec327f39ac2af
SHA1

def6b8c24e7bc476d1260499f51885bd7fb3fd69
SHA256

73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25
SHA512

7b430cd802802d22ee5423d3dae92ee87fef18698fae43125a0d8b5c6c5740f93af076981345ad21d0e0bfacba08dd2cba02002dea3c8f4d2a5d34e637cdc3c9
SSDEEP

3072:V+biqYv27xcRI7KmR3XatDLJbfdI7o7X1DfrNo9e/JsY9fK9Hc:V+bDO2NcWR3XwlbbX9rx9y

Score

8^/10

ransomware

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

Processes:

73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CompressSave.png.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
File opened for modification	C:\Users\Admin\Pictures\JoinPop.png.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
File opened for modification	C:\Users\Admin\Pictures\ReadStart.raw.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
File opened for modification	C:\Users\Admin\Pictures\RedoMount.raw.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe

C:\Users\Admin\AppData\Local\Temp\73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
"C:\Users\Admin\AppData\Local\Temp\73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe"
1⤵
- Modifies extensions of user files
PID:2016

memory/2016-54-0x0000000000250000-0x00000000002A8000-memory.dmp

Filesize
352KB

Download
memory/2016-55-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x000000001B566000-0x000000001B585000-memory.dmp

Filesize
124KB

Download