Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2022 18:30

General

  • Target

    aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe

  • Size

    1.3MB

  • MD5

    2ef92f8ab2b6820d6eb559167676c1f4

  • SHA1

    628121779da83ae14822129da6c14b2bfbb2f7d1

  • SHA256

    aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50

  • SHA512

    20fd0a4d367268e55033f6d7f700998b52775921f7c2993656379c4103daa3c7cc07f8a6a82d9ec948c6c1b427937af4df433ec24fdfa9ce88c9050de70c28dc

  • SSDEEP

    24576:LTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:LT7RseZDT2tSbvQsIbe8YVjPH81

Malware Config

Signatures

  • Detect MafiaWare666 ransomware 1 IoCs
  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops desktop.ini file(s) 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
    "C:\Users\Admin\AppData\Local\Temp\aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1720-54-0x0000000000280000-0x00000000003D2000-memory.dmp

    Filesize

    1.3MB

  • memory/1720-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

    Filesize

    8KB

  • memory/1720-56-0x0000000004E65000-0x0000000004E76000-memory.dmp

    Filesize

    68KB

  • memory/1720-57-0x0000000004E65000-0x0000000004E76000-memory.dmp

    Filesize

    68KB