mafiaware666 | aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
Size

1.3MB
MD5

2ef92f8ab2b6820d6eb559167676c1f4
SHA1

628121779da83ae14822129da6c14b2bfbb2f7d1
SHA256

aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50
SHA512

20fd0a4d367268e55033f6d7f700998b52775921f7c2993656379c4103daa3c7cc07f8a6a82d9ec948c6c1b427937af4df433ec24fdfa9ce88c9050de70c28dc
SSDEEP

24576:LTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:LT7RseZDT2tSbvQsIbe8YVjPH81

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1092-54-0x0000000000B30000-0x0000000000C82000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\EnableClose.tif.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\HideExpand.tiff.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File opened for modification	C:\Users\Admin\Pictures\HideExpand.tiff	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\RepairReceive.tif.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\SyncSet.tiff.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File opened for modification	C:\Users\Admin\Pictures\SyncSet.tiff	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\TestUnlock.crw.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\DisableWatch.raw.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\ExitReceive.png.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\ExportComplete.png.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\FindLock.png.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
File created	C:\Users\Admin\Pictures\TestPublish.tif.sorry	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe

C:\Users\Admin\AppData\Local\Temp\aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe
"C:\Users\Admin\AppData\Local\Temp\aaa8dbb92ce458f0499725107eeed703243837acf79f489d20c4f3881c81fd50.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000B30000-0x0000000000C82000-memory.dmp

Filesize
1.3MB

Download
memory/1092-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1092-56-0x0000000004B15000-0x0000000004B26000-memory.dmp

Filesize
68KB

Download