Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 18:30
Behavioral task
behavioral1
Sample
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
Resource
win10v2004-20220901-en
General
-
Target
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
-
Size
1.3MB
-
MD5
2ef92f8ab2b6820d6eb559167676c1f4
-
SHA1
628121779da83ae14822129da6c14b2bfbb2f7d1
-
SHA256
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50
-
SHA512
20fd0a4d367268e55033f6d7f700998b52775921f7c2993656379c4103daa3c7cc07f8a6a82d9ec948c6c1b427937af4df433ec24fdfa9ce88c9050de70c28dc
-
SSDEEP
24576:LTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:LT7RseZDT2tSbvQsIbe8YVjPH81
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-54-0x0000000000280000-0x00000000003D2000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exedescription ioc process File created C:\Users\Admin\Pictures\MountGet.crw.sorry aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe File created C:\Users\Admin\Pictures\PopReceive.tiff.sorry aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe File opened for modification C:\Users\Admin\Pictures\PopReceive.tiff aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe File created C:\Users\Admin\Pictures\SelectRead.png.sorry aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\desktop.ini aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe