Analysis
-
max time kernel
151s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-12-2022 18:47
Behavioral task
behavioral1
Sample
WindowsFormsApp1.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsFormsApp1.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
WindowsFormsApp1.exe
-
Size
14.5MB
-
MD5
6c8868a84d7667ba67ba4458fa5acaac
-
SHA1
1fd296e86f968d3b183d0caaaa5bcd79c95d9d1f
-
SHA256
63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808
-
SHA512
f081767ec38815f51e5d55e722d8389e442991d91e2792221b793e2170c30f976dc53ac0142b277beb7ccad2e342e313e48003a478f6720d4681ff7cfb6e047a
-
SSDEEP
196608:mz+BXp17ELB4ruPT6RbzNde8kfhifUG2hqSFMMAjqSFMMA:C2D88STIbzzzkfhiJ6JQJ
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral1/memory/1784-54-0x00000000003E0000-0x0000000001266000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini WindowsFormsApp1.exe -
Drops desktop.ini file(s) 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini WindowsFormsApp1.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\12520437.cpx.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Windows\SysWOW64\12520437.cpx WindowsFormsApp1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\USP10.DLL.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\WISC30.DLL WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FNT.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSSOAPR3.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPTINPS.DLL.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\SETUP.XML WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\desktop.ini.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.OBPA=D WindowsFormsApp1.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf.OBPA=D WindowsFormsApp1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\bfsvc.exe.OBPA=D WindowsFormsApp1.exe File opened for modification C:\Windows\bfsvc.exe WindowsFormsApp1.exe