Analysis
-
max time kernel
112s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-04-2023 11:41
Behavioral task
behavioral1
Sample
Ransomware.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
Ransomware.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
Ransomware.exe
-
Size
322KB
-
MD5
39f33d6842fa6495ccd7a41e8ddcb9b8
-
SHA1
61cd2b3e22e2e6e514d611d3154e001f7e9fd195
-
SHA256
416d2f821b7cb984859cfce43be981c5c9bc1489446ba41951c041d5801b65cb
-
SHA512
97e8b15b82b70efebbf5cbfbbd4ac4925a7300049f5866bf01b59396de43c633342b5bc2ed657aae573c9f77e2dd20fe67234110aef048c49a2af9c8bd45dc29
-
SSDEEP
3072:iMMFnguNpdYSkMXV2KMMEuWgY792XaY6UTuuAk2usbA+klAGPqhdp4efHxub8ehY:ideMXVeuWgY79OWpmq/yQxuAeS9Jb/
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-54-0x0000000000820000-0x0000000000876000-memory.dmp family_mafiaware666 behavioral1/memory/1996-55-0x0000000004A30000-0x0000000004A70000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Ransomware.exedescription ioc Process File created C:\Users\Admin\Pictures\InvokeBlock.raw.Locked Ransomware.exe File created C:\Users\Admin\Pictures\RequestUnblock.crw.Locked Ransomware.exe File created C:\Users\Admin\Pictures\SendUpdate.png.Locked Ransomware.exe File created C:\Users\Admin\Pictures\WriteUnblock.png.Locked Ransomware.exe File created C:\Users\Admin\Pictures\CloseJoin.tiff.Locked Ransomware.exe File created C:\Users\Admin\Pictures\CompressMount.tiff.Locked Ransomware.exe File created C:\Users\Admin\Pictures\ProtectPing.tif.Locked Ransomware.exe File opened for modification C:\Users\Admin\Pictures\CloseJoin.tiff Ransomware.exe File opened for modification C:\Users\Admin\Pictures\CompressMount.tiff Ransomware.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
Ransomware.exedescription ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini Ransomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Ransomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Ransomware.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 1600 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid Process Token: 33 948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 948 AUDIODG.EXE Token: 33 948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 948 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Ransomware.exepid Process 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe 1996 Ransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
PID:1996
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ENCRYPTED_FILES.Locked.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1600
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1704
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5081⤵
- Suspicious use of AdjustPrivilegeToken
PID:948
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD59b571a4c5e7fae04334be40c87ac415a
SHA1e93bd1bf128b5da075fe9741d395a558da85849b
SHA256fa705830ab3920a9d7978fb4a8f1b6d4d0f1189675ef8cb10049157ea980b738
SHA51228a563e5dc1d660c3298092e6201051b3145eb884739c6896de88d8a7b2a953966223c2526f2111fa8cd3ba09eee559ac346a68f92fbe62b46ea9f0e8b9935f1