mafiaware666 | 5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8

Analysis

max time kernel
61s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 11:12

Target

5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
Size

1.3MB
MD5

01263ebcd849336af45ee59472585bdc
SHA1

02a9e25885a8c83d292a14c9a362e5997aea56b6
SHA256

5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8
SHA512

f7507cedb19f2baba6f55603fcc3cad89415cb7742858fa7f2ecfe575717232f99df4212617d5aaa92971fde8d56139c35f9d5d5e4ace835e03e4f1405313a34
SSDEEP

24576:7TSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:7T7RseZDT2tSbvQsIbe8YVjPH81

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/536-54-0x0000000000F10000-0x0000000001062000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\ProtectEnter.tiff.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\SaveConvertFrom.crw.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\SelectStart.raw.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\SendExpand.png.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\AssertSelect.crw.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\ConnectPublish.raw.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File opened for modification	C:\Users\Admin\Pictures\MergeResolve.tiff	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File opened for modification	C:\Users\Admin\Pictures\ProtectEnter.tiff	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\HideRestore.tif.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File created	C:\Users\Admin\Pictures\MergeResolve.tiff.jcrypt	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	5d4ba2e6cc18dc509e73f3ceeea82a83ca252d07444a6b669947d31f60c6dfb8.exe

memory/536-54-0x0000000000F10000-0x0000000001062000-memory.dmp

Filesize
1.3MB

Download
memory/536-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/536-56-0x0000000004FE5000-0x0000000004FF6000-memory.dmp

Filesize
68KB

Download