mafiaware666 | 8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752

Analysis

max time kernel
49s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 04:52

Target

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
Size

267KB
MD5

ef2faf4191b9a3e622ec8496c653bc4c
SHA1

adc4411fd1248f9846dc67c8978d5d553809b075
SHA256

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752
SHA512

fbc65375233b94bd5bfc69ddaf8a0367aaf5b3906b45f8d16ad56add1e97ef221993fc2dbced810017298ceef278b72e4f66d71601a0e7feb9f7a0e36f9f62ef
SSDEEP

3072:eszNtrCvGJKHRMGM6y7CGtEKqljDjn+AaErIcIqaGqPIhkp/7oL0DDlUU8NH79BS:P7KHRMGM7/LqRh9kfGqPHhoL0/lUUaB

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1848-54-0x0000000000180000-0x00000000001C8000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\SubmitConfirm.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\SubmitImport.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\AddJoin.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\RequestWatch.tiff	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\ConvertToMount.tif.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\GetOpen.raw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\RequestWatch.tiff.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\ConfirmReset.tiff.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmReset.tiff	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

memory/1848-54-0x0000000000180000-0x00000000001C8000-memory.dmp

Filesize
288KB

Download
memory/1848-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1848-56-0x0000000004DB5000-0x0000000004DC6000-memory.dmp

Filesize
68KB

Download
memory/1848-57-0x0000000004DB5000-0x0000000004DC6000-memory.dmp

Filesize
68KB

Download