mafiaware666 | 63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808

General

Target

WindowsFormsApp1.exe
Size

14.5MB
MD5

6c8868a84d7667ba67ba4458fa5acaac
SHA1

1fd296e86f968d3b183d0caaaa5bcd79c95d9d1f
SHA256

63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808
SHA512

f081767ec38815f51e5d55e722d8389e442991d91e2792221b793e2170c30f976dc53ac0142b277beb7ccad2e342e313e48003a478f6720d4681ff7cfb6e047a
SSDEEP

196608:mz+BXp17ELB4ruPT6RbzNde8kfhifUG2hqSFMMAjqSFMMA:C2D88STIbzzzkfhiJ6JQJ

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1976-54-0x0000000000D30000-0x0000000001BB6000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Drops startup file 2 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	WindowsFormsApp1.exe

Drops desktop.ini file(s) 8 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	WindowsFormsApp1.exe

Drops file in System32 directory 2 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\12520437.cpx.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Windows\SysWOW64\12520437.cpx	WindowsFormsApp1.exe

Drops file in Program Files directory 64 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FNT	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\sentinel	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PICTIM32.FLT	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\eqnedt32.exe.manifest.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll.OBPA=D	WindowsFormsApp1.exe

Drops file in Windows directory 2 IoCs

Processes:

WindowsFormsApp1.exe

description ioc process

File created C:\Windows\bfsvc.exe.OBPA=D WindowsFormsApp1.exe
File opened for modification C:\Windows\bfsvc.exe WindowsFormsApp1.exe

description	ioc	process
File created	C:\Windows\bfsvc.exe.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Windows\bfsvc.exe	WindowsFormsApp1.exe

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000000D30000-0x0000000001BB6000-memory.dmp

Filesize
14.5MB

Download
memory/1976-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000005A05000-0x0000000005A16000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads