mafiaware666 | 8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752

Analysis

max time kernel
38s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-12-2022 17:18

Target

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
Size

267KB
MD5

ef2faf4191b9a3e622ec8496c653bc4c
SHA1

adc4411fd1248f9846dc67c8978d5d553809b075
SHA256

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752
SHA512

fbc65375233b94bd5bfc69ddaf8a0367aaf5b3906b45f8d16ad56add1e97ef221993fc2dbced810017298ceef278b72e4f66d71601a0e7feb9f7a0e36f9f62ef
SSDEEP

3072:eszNtrCvGJKHRMGM6y7CGtEKqljDjn+AaErIcIqaGqPIhkp/7oL0DDlUU8NH79BS:P7KHRMGM7/LqRh9kfGqPHhoL0/lUUaB

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1696-54-0x00000000010A0000-0x00000000010E8000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\CompareEnable.png.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\DismountExpand.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\FindHide.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\ResolveCompress.tif.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

memory/1696-54-0x00000000010A0000-0x00000000010E8000-memory.dmp

Filesize
288KB

Download
memory/1696-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000004A35000-0x0000000004A46000-memory.dmp

Filesize
68KB

Download