mafiaware666 | 63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808

General

Target

WindowsFormsApp1.exe
Size

14.5MB
MD5

6c8868a84d7667ba67ba4458fa5acaac
SHA1

1fd296e86f968d3b183d0caaaa5bcd79c95d9d1f
SHA256

63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808
SHA512

f081767ec38815f51e5d55e722d8389e442991d91e2792221b793e2170c30f976dc53ac0142b277beb7ccad2e342e313e48003a478f6720d4681ff7cfb6e047a
SSDEEP

196608:mz+BXp17ELB4ruPT6RbzNde8kfhifUG2hqSFMMAjqSFMMA:C2D88STIbzzzkfhiJ6JQJ

Score

10^/10

mafiaware666 ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4992-132-0x0000000000EC0000-0x0000000001D46000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Drops startup file 2 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	WindowsFormsApp1.exe

Drops desktop.ini file(s) 8 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	WindowsFormsApp1.exe

Drops file in System32 directory 2 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\12520437.cpx.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Windows\SysWOW64\12520437.cpx	WindowsFormsApp1.exe

Drops file in Program Files directory 64 IoCs

Processes:

WindowsFormsApp1.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libEGL.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPS.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\chrome_elf.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFPrevHndlr.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXE8SharedExpat.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_base_non_fips.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pe.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv58.dll.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\CoolType.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ExtendScript.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp.OBPA=D	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv58.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Res.dll	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll.OBPA=D	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGM.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_asym.dll	WindowsFormsApp1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp	WindowsFormsApp1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp.OBPA=D	WindowsFormsApp1.exe

Drops file in Windows directory 2 IoCs

Processes:

WindowsFormsApp1.exe

description ioc process

File opened for modification C:\Windows\bfsvc.exe WindowsFormsApp1.exe
File created C:\Windows\bfsvc.exe.OBPA=D WindowsFormsApp1.exe

description	ioc	process
File opened for modification	C:\Windows\bfsvc.exe	WindowsFormsApp1.exe
File created	C:\Windows\bfsvc.exe.OBPA=D	WindowsFormsApp1.exe

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-132-0x0000000000EC0000-0x0000000001D46000-memory.dmp

Filesize
14.5MB

Download
memory/4992-133-0x0000000006D30000-0x00000000072D4000-memory.dmp

Filesize
5.6MB

Download
memory/4992-134-0x0000000006780000-0x0000000006812000-memory.dmp

Filesize
584KB

Download
memory/4992-135-0x00000000066F0000-0x00000000066FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads