Analysis
-
max time kernel
145s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 11:06
Behavioral task
behavioral1
Sample
221012-nbxc4adda8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
221012-nbxc4adda8.exe
Resource
win10v2004-20240226-en
General
-
Target
221012-nbxc4adda8.exe
-
Size
1.1MB
-
MD5
52ca0a4cd932e61091d04bff0f927f51
-
SHA1
bd2cf4c800d907e568d8db3a2ecafa5fc8426079
-
SHA256
89ebe17b6dbb9dac780a4e2fe38da0261fa671cc79f4fe07cb9d26d9c0e447d2
-
SHA512
742011bf2fdd37e8fe33d1b3549f7d302a94dd1abff4885ff173272c88054710fcef740159ff8068a4227e8d7557e52674c11d6568501aa4d1359335ee7767fc
-
SSDEEP
24576:+b9wVn7NN9zvW/xAcQTMHt7WQNP6Rr54ZM+WTpAtJU45WCYJjeszBaDG:sSVN+/+MHtpG58M+WTpQJU45WCOieaDG
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/628-1-0x0000000000D30000-0x0000000000E52000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 5 IoCs
Processes:
221012-nbxc4adda8.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini 221012-nbxc4adda8.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 221012-nbxc4adda8.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 221012-nbxc4adda8.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 221012-nbxc4adda8.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 221012-nbxc4adda8.exe