Analysis
- max time kernel
62s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
01/05/2024, 10:16
Behavioral task
behavioral1
Sample
Chrome.msi
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chrome.msi
Resource
win10v2004-20240419-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target Chrome.msi
- Size 288KB
- Sample240501-ma925aeg23
- SHA256 ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
- MD5 10cca9ff7368ddfb2301d36fa386669a
- SHA1 9ec12af4a97eda16513aa51ec685601c64eec626
- SHA512 c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
- SSDEEP 3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect MafiaWare666 ransomware 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023ba1-61.dat family_mafiaware666 behavioral2/files/0x000a000000023ba4-68.dat family_mafiaware666 behavioral2/memory/4036-70-0x0000000000780000-0x000000000078E000-memory.dmp family_mafiaware666 - MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
- Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Modifies file permissions 1 TTPs 1 IoCs
pid Process 2896 ICACLS.EXE - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini WindowsFormsApp1_original.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{397740B8-798B-4DEB-9E03-ACFFDDD4BF05} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI72DE.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e5771c5.msi msiexec.exe File opened for modification C:\Windows\Installer\e5771c5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE - Executes dropped EXE 1 IoCs
pid Process 4036 WindowsFormsApp1_original.exe - Loads dropped DLL 1 IoCs
pid Process 3404 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000324c0cbb4829e1b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000324c0cbb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900324c0cbb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d324c0cbb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000324c0cbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 220 msiexec.exe Token: SeIncreaseQuotaPrivilege 220 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeCreateTokenPrivilege 220 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 220 msiexec.exe Token: SeLockMemoryPrivilege 220 msiexec.exe Token: SeIncreaseQuotaPrivilege 220 msiexec.exe Token: SeMachineAccountPrivilege 220 msiexec.exe Token: SeTcbPrivilege 220 msiexec.exe Token: SeSecurityPrivilege 220 msiexec.exe Token: SeTakeOwnershipPrivilege 220 msiexec.exe Token: SeLoadDriverPrivilege 220 msiexec.exe Token: SeSystemProfilePrivilege 220 msiexec.exe Token: SeSystemtimePrivilege 220 msiexec.exe Token: SeProfSingleProcessPrivilege 220 msiexec.exe Token: SeIncBasePriorityPrivilege 220 msiexec.exe Token: SeCreatePagefilePrivilege 220 msiexec.exe Token: SeCreatePermanentPrivilege 220 msiexec.exe Token: SeBackupPrivilege 220 msiexec.exe Token: SeRestorePrivilege 220 msiexec.exe Token: SeShutdownPrivilege 220 msiexec.exe Token: SeDebugPrivilege 220 msiexec.exe Token: SeAuditPrivilege 220 msiexec.exe Token: SeSystemEnvironmentPrivilege 220 msiexec.exe Token: SeChangeNotifyPrivilege 220 msiexec.exe Token: SeRemoteShutdownPrivilege 220 msiexec.exe Token: SeUndockPrivilege 220 msiexec.exe Token: SeSyncAgentPrivilege 220 msiexec.exe Token: SeEnableDelegationPrivilege 220 msiexec.exe Token: SeManageVolumePrivilege 220 msiexec.exe Token: SeImpersonatePrivilege 220 msiexec.exe Token: SeCreateGlobalPrivilege 220 msiexec.exe Token: SeBackupPrivilege 1532 vssvc.exe Token: SeRestorePrivilege 1532 vssvc.exe Token: SeAuditPrivilege 1532 vssvc.exe Token: SeBackupPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 3912 srtasks.exe Token: SeRestorePrivilege 3912 srtasks.exe Token: SeSecurityPrivilege 3912 srtasks.exe Token: SeTakeOwnershipPrivilege 3912 srtasks.exe Token: SeBackupPrivilege 3912 srtasks.exe Token: SeRestorePrivilege 3912 srtasks.exe Token: SeSecurityPrivilege 3912 srtasks.exe Token: SeTakeOwnershipPrivilege 3912 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 220 msiexec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3912 2872 msiexec.exe 92 PID 2872 wrote to memory of 3912 2872 msiexec.exe 92 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 2872 wrote to memory of 3404 2872 msiexec.exe 94 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 2896 3404 MsiExec.exe 95 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4124 3404 MsiExec.exe 97 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 PID 3404 wrote to memory of 4036 3404 MsiExec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:220
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7D7820953F3F926F3DBBDE890309B112⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2896
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe"C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe"3⤵
- Drops desktop.ini file(s)
- Executes dropped EXE
PID:4036
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files.cab
- Size 37KB
- SHA256 040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc
- MD5 b050ee720b47e099ebeb9fb585ddcd80
- SHA1 710b83b1c892872623581cc629a22f7f58672651
- SHA512 86209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e
- SSDEEP 768:Ml92MKPaSMaxJnHMRs0IC2jNc7MW9yInefBR5:MlSDhxRO0cr9yIiR5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe
- Size 37KB
- SHA256 1e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179
- MD5 fcb4ddf79552dbc16151c4f002e72a81
- SHA1 5a6655bf73e42c6e0eb35b58aba5bba91745fb49
- SHA512 2ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3
- SSDEEP 768:192MKPaSMaxJnHMRs0IC2jNc7MW9yInefB+5:1SDhxRO0cr9yIi+5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\msiwrapper.ini
- Size 1KB
- SHA256 92dffeb007ec032ab4c4ff53765cec9985c399488528af0e74d4834b4dab708a
- MD5 57ae6d5b983d6f077152d28749c1d1ab
- SHA1 641d991977ed7198e618eef86ec7dac91523dda9
- SHA512 a50553d11b2eb8470339cb43d0d3caf7de0b403dd9ec83e41453e1649eed5503cd0bd967bccad52087cb4f3661278354854e2b36fb60a8b9af9cea20d474b73b
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI72DE.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 af6f5c48a4b962c86ec5e429e48d5cba54a3a121cbca5aa258f86df2ba2284cb
- MD5 69fed8194dbe44f0fab81cfb42ff1580
- SHA1 f1520fac1d6bbd96a68d123d761d97135543a3a2
- SHA512 e194ce472a02c4ac7437d67f3b735f58c8ed37df7e405ab24300d5c1a723516490475310ec55f28e4a77e7b3d48718cf0e92544bb8e9ea67d9ac327e6ed3bc58
- SSDEEP 24576:UZxm+1dHdoO/vvTLr24eNm685BrRgVDi0uGN63JlwU6JuvhJIv17g+Tx7l:4A
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5fc03863-1854-4ea3-a2d3-14c40c755e83}_OnDiskSnapshotProp
- Size 6KB
- SHA256 9a9a62cbfc40ed3afbcb428454cdfe82dca3cfbc32396948bdbe48ceac6467cb
- MD5 ab2d184fc523dcdbdbe9eae961d87739
- SHA1 90b26ee6032f00f870969ac6db15eac03567094d
- SHA512 936f0281e70d21beeb09c7fe2d9ff36768a3fc8384d601cd2ef744f61b55c9ae5eeab77bf28eb023bba8236bdf0194c20f9be428c53fef6b1d2ab973e8f8abf4
- SSDEEP 96:Fdk0JrP4xDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpuN:Xkrb++lVmN
- MD5 SHA1 SHA512 SSDEEP