Analysis
-
max time kernel
172s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 15:21
Behavioral task
behavioral1
Sample
1BF9BA066C58D63FE622378E42C5A95B.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1BF9BA066C58D63FE622378E42C5A95B.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
1BF9BA066C58D63FE622378E42C5A95B.exe
-
Size
180KB
-
MD5
1bf9ba066c58d63fe622378e42c5a95b
-
SHA1
c884f707f77be72e777f9788a57bca599f703566
-
SHA256
f9796af1fc999b1fb0add873da217e7f9209ebf01372d1c290e307ddb73a0f0f
-
SHA512
63c799e4fa3278e8173d224944572d962ac05f927e0bc7cdd4ce34b3638f778d05890d9462cff045389126c97438da0914f63972cd2e68142da0d54535191286
-
SSDEEP
3072:Xf9IKFtKw1Y95tupSo9z9+HUvNGpCucXm:XfOiKwE5IEo9zwHq
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral2/memory/2620-132-0x00000000004F0000-0x0000000000522000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" 1BF9BA066C58D63FE622378E42C5A95B.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\DisconnectCopy.raw.jcrypt 1BF9BA066C58D63FE622378E42C5A95B.exe File created C:\Users\Admin\Pictures\FormatRequest.tif.jcrypt 1BF9BA066C58D63FE622378E42C5A95B.exe File created C:\Users\Admin\Pictures\StartConnect.png.jcrypt 1BF9BA066C58D63FE622378E42C5A95B.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokenPc = "C:\\Windows\\SystemFiles.exe" 1BF9BA066C58D63FE622378E42C5A95B.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokenPc = "C:\\Windows\\brokenpc.exe" 1BF9BA066C58D63FE622378E42C5A95B.exe -
Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1BF9BA066C58D63FE622378E42C5A95B.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\brokenpc.exe 1BF9BA066C58D63FE622378E42C5A95B.exe File created C:\Windows\SystemFiles.exe 1BF9BA066C58D63FE622378E42C5A95B.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe 2620 1BF9BA066C58D63FE622378E42C5A95B.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2620 1BF9BA066C58D63FE622378E42C5A95B.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1BF9BA066C58D63FE622378E42C5A95B.exe"C:\Users\Admin\AppData\Local\Temp\1BF9BA066C58D63FE622378E42C5A95B.exe"1⤵
- Modifies WinLogon for persistence
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620