mafiaware666 | d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 04:12

Target
d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
Size 491KB
Sample221017-esls9aagen
SHA256 d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0
MD5 7025e419fd671779fc0b8d2fc7c05cb2
SHA1 b6beedea2aaea31c19251737eb7be64d9b4a1b6c
SHA512 6a014f9a79571bd3479535885b86646c6d96cf27253ee9f08cc906bb5f31ad3ac8845ee9443636a76c82c2a5267460b79b9677d8b3d8bedb0ddeb85ce2c9a1bc
SSDEEP 3072:qC/zf+qP9BT1s2IytGqVToMdePYUd6zB9BkcbMP3lFIm+MNjpkbsvYWvvKwtv4qP:DzmcdBGxNY8Qj+YptsW6hxRspQQQQQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/5072-132-0x0000000000B00000-0x0000000000B80000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\ConvertLock.tif.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\InstallPing.tiff.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File opened for modification	C:\Users\Admin\Pictures\InstallPing.tiff	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\OptimizeShow.png.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\ResizeCopy.crw.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\CheckpointEnter.raw.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\CompleteWrite.png.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\InitializeSkip.crw.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File created	C:\Users\Admin\Pictures\MeasureInstall.crw.mr.trojan	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	d6fc6ebef39b6bf316912de44a7610966f738b4866b117240923d1a65ea6a3f0.exe

memory/5072-132-0x0000000000B00000-0x0000000000B80000-memory.dmp

Download

memory/5072-133-0x0000000005C60000-0x0000000006204000-memory.dmp

Download

memory/5072-134-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/5072-135-0x0000000005520000-0x000000000552A000-memory.dmp

Download