mafiaware666 | 8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752

Analysis

max time kernel
99s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2022 17:18

Target

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
Size

267KB
MD5

ef2faf4191b9a3e622ec8496c653bc4c
SHA1

adc4411fd1248f9846dc67c8978d5d553809b075
SHA256

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752
SHA512

fbc65375233b94bd5bfc69ddaf8a0367aaf5b3906b45f8d16ad56add1e97ef221993fc2dbced810017298ceef278b72e4f66d71601a0e7feb9f7a0e36f9f62ef
SSDEEP

3072:eszNtrCvGJKHRMGM6y7CGtEKqljDjn+AaErIcIqaGqPIhkp/7oL0DDlUU8NH79BS:P7KHRMGM7/LqRh9kfGqPHhoL0/lUUaB

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3624-132-0x0000000000260000-0x00000000002A8000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\SendBlock.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\UnpublishRestart.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\DenyHide.tiff	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\ResolveGroup.tiff.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\MergeResolve.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveGroup.tiff	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\WatchDisable.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\WriteOptimize.png.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\ConvertToLock.png.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\DenyHide.tiff.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

memory/3624-132-0x0000000000260000-0x00000000002A8000-memory.dmp

Filesize
288KB

Download
memory/3624-133-0x00000000052B0000-0x0000000005854000-memory.dmp

Filesize
5.6MB

Download
memory/3624-134-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/3624-135-0x0000000004D00000-0x0000000004D0A000-memory.dmp

Filesize
40KB

Download