mafiaware666 | 6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 11:11

Target

6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
Size

182KB
MD5

3bea60c117d46fd32d5d3a86a98befa5
SHA1

44348e1d4bfddbdea9bdff3b65136f5c9ba94329
SHA256

6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265
SHA512

a08020463afc0eed6463e844ad689d144637998d5ab49f83a1473b7815b56a7607fe68b3aaf27b87ba8c3176cddad26e3ab6babbd630ce5a9d34b40c567331a1
SSDEEP

3072://5btPWv27xcRI7KmR3XatDLJb/dI7o7X1DfrNo9e/JsYX:/hbt42NcWR3Xwlb7X9rx

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1812-54-0x0000000000970000-0x00000000009A4000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\JoinGrant.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\LimitConvertFrom.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\PingSelect.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\TestUse.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmUnregister.png.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\EditPublish.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe

C:\Users\Admin\AppData\Local\Temp\6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
"C:\Users\Admin\AppData\Local\Temp\6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe"
1⤵
- Modifies extensions of user files
PID:1812

memory/1812-54-0x0000000000970000-0x00000000009A4000-memory.dmp

Filesize
208KB

Download
memory/1812-55-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x000000001B036000-0x000000001B055000-memory.dmp

Filesize
124KB

Download