mafiaware666 | 6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265

Analysis

max time kernel
141s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 11:11

Target

6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
Size

182KB
MD5

3bea60c117d46fd32d5d3a86a98befa5
SHA1

44348e1d4bfddbdea9bdff3b65136f5c9ba94329
SHA256

6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265
SHA512

a08020463afc0eed6463e844ad689d144637998d5ab49f83a1473b7815b56a7607fe68b3aaf27b87ba8c3176cddad26e3ab6babbd630ce5a9d34b40c567331a1
SSDEEP

3072://5btPWv27xcRI7KmR3XatDLJb/dI7o7X1DfrNo9e/JsYX:/hbt42NcWR3Xwlb7X9rx

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2112-132-0x0000000000250000-0x0000000000284000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\UnregisterReceive.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\EnterStep.crw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\NewCompare.crw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\WritePublish.png.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
File opened for modification	C:\Users\Admin\Pictures\RestoreOut.raw.MafiaWare666	6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe

C:\Users\Admin\AppData\Local\Temp\6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe
"C:\Users\Admin\AppData\Local\Temp\6e91c9b5d052842093c6c292ec8224755d376aba6172d94faa241d8b192cb265.exe"
1⤵
- Modifies extensions of user files
PID:2112

memory/2112-132-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2112-133-0x00007FFC18140000-0x00007FFC18C01000-memory.dmp

Filesize
10.8MB

Download
memory/2112-134-0x00007FFC18140000-0x00007FFC18C01000-memory.dmp

Filesize
10.8MB

Download