Analysis
-
max time kernel
153s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 15:12
Behavioral task
behavioral1
Sample
6B3DB1E9DBA9D6FC75F90D047067395D.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
6B3DB1E9DBA9D6FC75F90D047067395D.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6B3DB1E9DBA9D6FC75F90D047067395D.exe
-
Size
99KB
-
MD5
6b3db1e9dba9d6fc75f90d047067395d
-
SHA1
f2eb7dac455ffd5d646375be74b75469faeb68ba
-
SHA256
8592d59a9a2252328e6843f9e8c2a565318a25340cafe0d5a54f4f5440407995
-
SHA512
a79faf8872a6f846ec5aebb5106e23a306b6b7eff90c52f3766b5b097eaba1e09d9a5c9efc62c86e10010cb99f0bb75529bb4dd0349a1ba286138cb886a00a65
-
SSDEEP
768:07ea8ZJDLJtAy0uJ16B0zBl3IS/rJUR5bKfO2yMMz/C1Yckin:SaJDb6B6B9pGR5bKfO2yZz/Cein
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral2/memory/2960-132-0x0000000000630000-0x000000000064E000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\FormatSelect.tif.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\GroupCopy.png.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Pictures\SendConvertFrom.tiff 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\StopCompare.png.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\UpdateCopy.png.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\ExportSearch.png.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\MergeResume.crw.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\StartSplit.raw.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\UnregisterExit.tiff.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\SendConvertFrom.tiff.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\ConvertFromReset.crw.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\GetProtect.crw.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Users\Admin\Pictures\NewResume.raw.jcrypt 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Pictures\UnregisterExit.tiff 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokenPc = "C:\\Windows\\SystemFiles.exe" 6B3DB1E9DBA9D6FC75F90D047067395D.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokenPc = "C:\\Windows\\brokenpc.exe" 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Music\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\brokenpc.exe 6B3DB1E9DBA9D6FC75F90D047067395D.exe File created C:\Windows\SystemFiles.exe 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2960 6B3DB1E9DBA9D6FC75F90D047067395D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6B3DB1E9DBA9D6FC75F90D047067395D.exe"C:\Users\Admin\AppData\Local\Temp\6B3DB1E9DBA9D6FC75F90D047067395D.exe"1⤵
- Modifies WinLogon for persistence
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960