mafiaware666 | 8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752

Analysis

max time kernel
106s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2022 04:52

Target

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
Size

267KB
MD5

ef2faf4191b9a3e622ec8496c653bc4c
SHA1

adc4411fd1248f9846dc67c8978d5d553809b075
SHA256

8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752
SHA512

fbc65375233b94bd5bfc69ddaf8a0367aaf5b3906b45f8d16ad56add1e97ef221993fc2dbced810017298ceef278b72e4f66d71601a0e7feb9f7a0e36f9f62ef
SSDEEP

3072:eszNtrCvGJKHRMGM6y7CGtEKqljDjn+AaErIcIqaGqPIhkp/7oL0DDlUU8NH79BS:P7KHRMGM7/LqRh9kfGqPHhoL0/lUUaB

Score

10^/10

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2484-132-0x0000000000A20000-0x0000000000A68000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\ConfirmAssert.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\DenyExport.tiff.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\DenyExport.tiff	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\CompressInitialize.crw.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File created	C:\Users\Admin\Pictures\CompressRename.png.CRYPT	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	8437b6ed38b42bb447c9e9ad095105315d430b07b98b1b829ad314186c0c1752.exe

memory/2484-132-0x0000000000A20000-0x0000000000A68000-memory.dmp

Filesize
288KB

Download
memory/2484-133-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download
memory/2484-134-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/2484-135-0x00000000054C0000-0x00000000054CA000-memory.dmp

Filesize
40KB

Download