mafiaware666 | f9796af1fc999b1fb0add873da217e7f9209ebf01372d1c290e307ddb73a0f0f | Triage

Analysis

max time kernel
30s
max time network
67s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 15:21

Sharing

Report Analysis Logs

General

Target

1BF9BA066C58D63FE622378E42C5A95B.exe
Size

180KB
MD5

1bf9ba066c58d63fe622378e42c5a95b
SHA1

c884f707f77be72e777f9788a57bca599f703566
SHA256

f9796af1fc999b1fb0add873da217e7f9209ebf01372d1c290e307ddb73a0f0f
SHA512

63c799e4fa3278e8173d224944572d962ac05f927e0bc7cdd4ce34b3638f778d05890d9462cff045389126c97438da0914f63972cd2e68142da0d54535191286
SSDEEP

3072:Xf9IKFtKw1Y95tupSo9z9+HUvNGpCucXm:XfOiKwE5IEo9zwHq

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1512-54-0x0000000000A40000-0x0000000000A72000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\brokenpc.exe	1BF9BA066C58D63FE622378E42C5A95B.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	1512	WerFault.exe	16

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	1BF9BA066C58D63FE622378E42C5A95B.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 544	1512	1BF9BA066C58D63FE622378E42C5A95B.exe	28
PID 1512 wrote to memory of 544	1512	1BF9BA066C58D63FE622378E42C5A95B.exe	28
PID 1512 wrote to memory of 544	1512	1BF9BA066C58D63FE622378E42C5A95B.exe	28
PID 1512 wrote to memory of 544	1512	1BF9BA066C58D63FE622378E42C5A95B.exe	28

C:\Users\Admin\AppData\Local\Temp\1BF9BA066C58D63FE622378E42C5A95B.exe
"C:\Users\Admin\AppData\Local\Temp\1BF9BA066C58D63FE622378E42C5A95B.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1188
  2⤵
  - Program crash
  PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-54-0x0000000000A40000-0x0000000000A72000-memory.dmp

Filesize
200KB

Download
memory/1512-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download