Analysis
-
max time kernel
62s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 10:16 UTC
Behavioral task
behavioral1
Sample
Chrome.msi
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chrome.msi
Resource
win10v2004-20240419-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Chrome.msi
-
Size
288KB
-
MD5
10cca9ff7368ddfb2301d36fa386669a
-
SHA1
9ec12af4a97eda16513aa51ec685601c64eec626
-
SHA256
ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
-
SHA512
c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
-
SSDEEP
3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023ba1-61.dat family_mafiaware666 behavioral2/files/0x000a000000023ba4-68.dat family_mafiaware666 behavioral2/memory/4036-70-0x0000000000780000-0x000000000078E000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2896 ICACLS.EXE -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini WindowsFormsApp1_original.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{397740B8-798B-4DEB-9E03-ACFFDDD4BF05} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI72DE.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e5771c5.msi msiexec.exe File opened for modification C:\Windows\Installer\e5771c5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE -
Executes dropped EXE 1 IoCs
pid Process 4036 WindowsFormsApp1_original.exe -
Loads dropped DLL 1 IoCs
pid Process 3404 MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000324c0cbb4829e1b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000324c0cbb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900324c0cbb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d324c0cbb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000324c0cbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 220 msiexec.exe Token: SeIncreaseQuotaPrivilege 220 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeCreateTokenPrivilege 220 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 220 msiexec.exe Token: SeLockMemoryPrivilege 220 msiexec.exe Token: SeIncreaseQuotaPrivilege 220 msiexec.exe Token: SeMachineAccountPrivilege 220 msiexec.exe Token: SeTcbPrivilege 220 msiexec.exe Token: SeSecurityPrivilege 220 msiexec.exe Token: SeTakeOwnershipPrivilege 220 msiexec.exe Token: SeLoadDriverPrivilege 220 msiexec.exe Token: SeSystemProfilePrivilege 220 msiexec.exe Token: SeSystemtimePrivilege 220 msiexec.exe Token: SeProfSingleProcessPrivilege 220 msiexec.exe Token: SeIncBasePriorityPrivilege 220 msiexec.exe Token: SeCreatePagefilePrivilege 220 msiexec.exe Token: SeCreatePermanentPrivilege 220 msiexec.exe Token: SeBackupPrivilege 220 msiexec.exe Token: SeRestorePrivilege 220 msiexec.exe Token: SeShutdownPrivilege 220 msiexec.exe Token: SeDebugPrivilege 220 msiexec.exe Token: SeAuditPrivilege 220 msiexec.exe Token: SeSystemEnvironmentPrivilege 220 msiexec.exe Token: SeChangeNotifyPrivilege 220 msiexec.exe Token: SeRemoteShutdownPrivilege 220 msiexec.exe Token: SeUndockPrivilege 220 msiexec.exe Token: SeSyncAgentPrivilege 220 msiexec.exe Token: SeEnableDelegationPrivilege 220 msiexec.exe Token: SeManageVolumePrivilege 220 msiexec.exe Token: SeImpersonatePrivilege 220 msiexec.exe Token: SeCreateGlobalPrivilege 220 msiexec.exe Token: SeBackupPrivilege 1532 vssvc.exe Token: SeRestorePrivilege 1532 vssvc.exe Token: SeAuditPrivilege 1532 vssvc.exe Token: SeBackupPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 3912 srtasks.exe Token: SeRestorePrivilege 3912 srtasks.exe Token: SeSecurityPrivilege 3912 srtasks.exe Token: SeTakeOwnershipPrivilege 3912 srtasks.exe Token: SeBackupPrivilege 3912 srtasks.exe Token: SeRestorePrivilege 3912 srtasks.exe Token: SeSecurityPrivilege 3912 srtasks.exe Token: SeTakeOwnershipPrivilege 3912 srtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 220 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3912 2872 msiexec.exe 92 PID 2872 wrote to memory of 3912 2872 msiexec.exe 92 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:220
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7D7820953F3F926F3DBBDE890309B112⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2896
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe"C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe"3⤵
- Drops desktop.ini file(s)
- Executes dropped EXE
PID:4036
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1532
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b050ee720b47e099ebeb9fb585ddcd80
SHA1710b83b1c892872623581cc629a22f7f58672651
SHA256040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc
SHA51286209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e
-
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe
Filesize37KB
MD5fcb4ddf79552dbc16151c4f002e72a81
SHA15a6655bf73e42c6e0eb35b58aba5bba91745fb49
SHA2561e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179
SHA5122ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3
-
Filesize
1KB
MD557ae6d5b983d6f077152d28749c1d1ab
SHA1641d991977ed7198e618eef86ec7dac91523dda9
SHA25692dffeb007ec032ab4c4ff53765cec9985c399488528af0e74d4834b4dab708a
SHA512a50553d11b2eb8470339cb43d0d3caf7de0b403dd9ec83e41453e1649eed5503cd0bd967bccad52087cb4f3661278354854e2b36fb60a8b9af9cea20d474b73b
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
-
Filesize
24.1MB
MD569fed8194dbe44f0fab81cfb42ff1580
SHA1f1520fac1d6bbd96a68d123d761d97135543a3a2
SHA256af6f5c48a4b962c86ec5e429e48d5cba54a3a121cbca5aa258f86df2ba2284cb
SHA512e194ce472a02c4ac7437d67f3b735f58c8ed37df7e405ab24300d5c1a723516490475310ec55f28e4a77e7b3d48718cf0e92544bb8e9ea67d9ac327e6ed3bc58
-
\??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5fc03863-1854-4ea3-a2d3-14c40c755e83}_OnDiskSnapshotProp
Filesize6KB
MD5ab2d184fc523dcdbdbe9eae961d87739
SHA190b26ee6032f00f870969ac6db15eac03567094d
SHA2569a9a62cbfc40ed3afbcb428454cdfe82dca3cfbc32396948bdbe48ceac6467cb
SHA512936f0281e70d21beeb09c7fe2d9ff36768a3fc8384d601cd2ef744f61b55c9ae5eeab77bf28eb023bba8236bdf0194c20f9be428c53fef6b1d2ab973e8f8abf4