mafiaware666 | a5314b9c3e7e58a045ed0276b13c7f5247c082938953d8151488b3f475ceb435 | Triage

Analysis

max time kernel
70s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 15:58

Sharing

Report Analysis Logs

General

Target

11540A93823F0CA6F8AF260616814226.exe
Size

180KB
MD5

11540a93823f0ca6f8af260616814226
SHA1

0405d1355d46fa94dacfb4088ba301a325777e60
SHA256

a5314b9c3e7e58a045ed0276b13c7f5247c082938953d8151488b3f475ceb435
SHA512

e9f4ea6e5140dc90e330c94ce3afa74824e95573ecf598ffd668bfb861f02ae6a510aa905b3b0884bdef6835eb02cbbda3786b97e700ab61a66db190769e00ca
SSDEEP

3072:xYc6JCKw1Y95tupSo9z9+HUvNGomucXm:xZKwE5IEo9zwHD

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1088-54-0x0000000000A80000-0x0000000000AB2000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\brokenpc.exe	11540A93823F0CA6F8AF260616814226.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1088	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	11540A93823F0CA6F8AF260616814226.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1548	1088	11540A93823F0CA6F8AF260616814226.exe	26
PID 1088 wrote to memory of 1548	1088	11540A93823F0CA6F8AF260616814226.exe	26
PID 1088 wrote to memory of 1548	1088	11540A93823F0CA6F8AF260616814226.exe	26
PID 1088 wrote to memory of 1548	1088	11540A93823F0CA6F8AF260616814226.exe	26

C:\Users\Admin\AppData\Local\Temp\11540A93823F0CA6F8AF260616814226.exe
"C:\Users\Admin\AppData\Local\Temp\11540A93823F0CA6F8AF260616814226.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1188
  2⤵
  - Program crash
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-54-0x0000000000A80000-0x0000000000AB2000-memory.dmp

Filesize
200KB

Download
memory/1088-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download