Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2022 17:52
Behavioral task
behavioral1
Sample
WindowsFormsApp1.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsFormsApp1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
WindowsFormsApp1.exe
-
Size
14.5MB
-
MD5
6c8868a84d7667ba67ba4458fa5acaac
-
SHA1
1fd296e86f968d3b183d0caaaa5bcd79c95d9d1f
-
SHA256
63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808
-
SHA512
f081767ec38815f51e5d55e722d8389e442991d91e2792221b793e2170c30f976dc53ac0142b277beb7ccad2e342e313e48003a478f6720d4681ff7cfb6e047a
-
SSDEEP
196608:mz+BXp17ELB4ruPT6RbzNde8kfhifUG2hqSFMMAjqSFMMA:C2D88STIbzzzkfhiJ6JQJ
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral2/memory/2780-132-0x0000000000FF0000-0x0000000001E76000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini WindowsFormsApp1.exe -
Drops desktop.ini file(s) 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini WindowsFormsApp1.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\12520437.cpx.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Windows\SysWOW64\12520437.cpx WindowsFormsApp1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_base.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt.dll WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIDE.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\CoolType.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\desktop.ini WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Review_RHP.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf WindowsFormsApp1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif.OBPA=D WindowsFormsApp1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\bfsvc.exe.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Windows\bfsvc.exe WindowsFormsApp1.exe