mafiaware666 | ec53369ff55e735e14b5b87eb793dabf043ce0fd7f93bc47fd0e5fd4fd7e6a77

General

Target

Chrome.msi
Size

288KB
MD5

10cca9ff7368ddfb2301d36fa386669a
SHA1

9ec12af4a97eda16513aa51ec685601c64eec626
SHA256

ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
SHA512

c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
SSDEEP

3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7

Score

10^/10

mafiaware666 discovery ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files.cab	family_mafiaware666
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe	family_mafiaware666
behavioral2/memory/4036-70-0x0000000000780000-0x000000000078E000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXE

pid process

2896 ICACLS.EXE

pid	process
2896	ICACLS.EXE

Drops desktop.ini file(s) 5 IoCs

Processes:

WindowsFormsApp1_original.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	WindowsFormsApp1_original.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeEXPAND.EXE

description	ioc	process
File created	C:\Windows\Installer\SourceHash{397740B8-798B-4DEB-9E03-ACFFDDD4BF05}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72DE.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e5771c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5771c5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

Processes:

WindowsFormsApp1_original.exe

pid process

4036 WindowsFormsApp1_original.exe
Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

3404 MsiExec.exe

pid	process
4036	WindowsFormsApp1_original.exe

pid	process
3404	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000324c0cbb4829e1b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000324c0cbb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900324c0cbb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d324c0cbb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000324c0cbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2872 msiexec.exe
2872 msiexec.exe

pid	process
2872	msiexec.exe
2872	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	220	msiexec.exe
Token: SeSecurityPrivilege	2872	msiexec.exe
Token: SeCreateTokenPrivilege	220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	220	msiexec.exe
Token: SeLockMemoryPrivilege	220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	220	msiexec.exe
Token: SeMachineAccountPrivilege	220	msiexec.exe
Token: SeTcbPrivilege	220	msiexec.exe
Token: SeSecurityPrivilege	220	msiexec.exe
Token: SeTakeOwnershipPrivilege	220	msiexec.exe
Token: SeLoadDriverPrivilege	220	msiexec.exe
Token: SeSystemProfilePrivilege	220	msiexec.exe
Token: SeSystemtimePrivilege	220	msiexec.exe
Token: SeProfSingleProcessPrivilege	220	msiexec.exe
Token: SeIncBasePriorityPrivilege	220	msiexec.exe
Token: SeCreatePagefilePrivilege	220	msiexec.exe
Token: SeCreatePermanentPrivilege	220	msiexec.exe
Token: SeBackupPrivilege	220	msiexec.exe
Token: SeRestorePrivilege	220	msiexec.exe
Token: SeShutdownPrivilege	220	msiexec.exe
Token: SeDebugPrivilege	220	msiexec.exe
Token: SeAuditPrivilege	220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	220	msiexec.exe
Token: SeChangeNotifyPrivilege	220	msiexec.exe
Token: SeRemoteShutdownPrivilege	220	msiexec.exe
Token: SeUndockPrivilege	220	msiexec.exe
Token: SeSyncAgentPrivilege	220	msiexec.exe
Token: SeEnableDelegationPrivilege	220	msiexec.exe
Token: SeManageVolumePrivilege	220	msiexec.exe
Token: SeImpersonatePrivilege	220	msiexec.exe
Token: SeCreateGlobalPrivilege	220	msiexec.exe
Token: SeBackupPrivilege	1532	vssvc.exe
Token: SeRestorePrivilege	1532	vssvc.exe
Token: SeAuditPrivilege	1532	vssvc.exe
Token: SeBackupPrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2872	msiexec.exe
Token: SeTakeOwnershipPrivilege	2872	msiexec.exe
Token: SeRestorePrivilege	2872	msiexec.exe
Token: SeTakeOwnershipPrivilege	2872	msiexec.exe
Token: SeBackupPrivilege	3912	srtasks.exe
Token: SeRestorePrivilege	3912	srtasks.exe
Token: SeSecurityPrivilege	3912	srtasks.exe
Token: SeTakeOwnershipPrivilege	3912	srtasks.exe
Token: SeBackupPrivilege	3912	srtasks.exe
Token: SeRestorePrivilege	3912	srtasks.exe
Token: SeSecurityPrivilege	3912	srtasks.exe
Token: SeTakeOwnershipPrivilege	3912	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

220 msiexec.exe

pid	process
220	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	process	target process
PID 2872 wrote to memory of 3912	2872	msiexec.exe	srtasks.exe
PID 2872 wrote to memory of 3912	2872	msiexec.exe	srtasks.exe
PID 2872 wrote to memory of 3404	2872	msiexec.exe	MsiExec.exe
PID 2872 wrote to memory of 3404	2872	msiexec.exe	MsiExec.exe
PID 2872 wrote to memory of 3404	2872	msiexec.exe	MsiExec.exe
PID 3404 wrote to memory of 2896	3404	MsiExec.exe	ICACLS.EXE
PID 3404 wrote to memory of 2896	3404	MsiExec.exe	ICACLS.EXE
PID 3404 wrote to memory of 2896	3404	MsiExec.exe	ICACLS.EXE
PID 3404 wrote to memory of 4124	3404	MsiExec.exe	EXPAND.EXE
PID 3404 wrote to memory of 4124	3404	MsiExec.exe	EXPAND.EXE
PID 3404 wrote to memory of 4124	3404	MsiExec.exe	EXPAND.EXE
PID 3404 wrote to memory of 4036	3404	MsiExec.exe	WindowsFormsApp1_original.exe
PID 3404 wrote to memory of 4036	3404	MsiExec.exe	WindowsFormsApp1_original.exe
PID 3404 wrote to memory of 4036	3404	MsiExec.exe	WindowsFormsApp1_original.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F7D7820953F3F926F3DBBDE890309B11
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2896
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Executes dropped EXE
    PID:4036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files.cab

Filesize
37KB

MD5
b050ee720b47e099ebeb9fb585ddcd80

SHA1
710b83b1c892872623581cc629a22f7f58672651

SHA256
040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc

SHA512
86209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\files\WindowsFormsApp1_original.exe

Filesize
37KB

MD5
fcb4ddf79552dbc16151c4f002e72a81

SHA1
5a6655bf73e42c6e0eb35b58aba5bba91745fb49

SHA256
1e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179

SHA512
2ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-33447956-1391-4b1e-9ce1-412010643780\msiwrapper.ini

Filesize
1KB

MD5
57ae6d5b983d6f077152d28749c1d1ab

SHA1
641d991977ed7198e618eef86ec7dac91523dda9

SHA256
92dffeb007ec032ab4c4ff53765cec9985c399488528af0e74d4834b4dab708a

SHA512
a50553d11b2eb8470339cb43d0d3caf7de0b403dd9ec83e41453e1649eed5503cd0bd967bccad52087cb4f3661278354854e2b36fb60a8b9af9cea20d474b73b

Download Submit
C:\Windows\Installer\MSI72DE.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
69fed8194dbe44f0fab81cfb42ff1580

SHA1
f1520fac1d6bbd96a68d123d761d97135543a3a2

SHA256
af6f5c48a4b962c86ec5e429e48d5cba54a3a121cbca5aa258f86df2ba2284cb

SHA512
e194ce472a02c4ac7437d67f3b735f58c8ed37df7e405ab24300d5c1a723516490475310ec55f28e4a77e7b3d48718cf0e92544bb8e9ea67d9ac327e6ed3bc58

Download Submit
\??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5fc03863-1854-4ea3-a2d3-14c40c755e83}_OnDiskSnapshotProp

Filesize
6KB

MD5
ab2d184fc523dcdbdbe9eae961d87739

SHA1
90b26ee6032f00f870969ac6db15eac03567094d

SHA256
9a9a62cbfc40ed3afbcb428454cdfe82dca3cfbc32396948bdbe48ceac6467cb

SHA512
936f0281e70d21beeb09c7fe2d9ff36768a3fc8384d601cd2ef744f61b55c9ae5eeab77bf28eb023bba8236bdf0194c20f9be428c53fef6b1d2ab973e8f8abf4

Download Submit
memory/4036-70-0x0000000000780000-0x000000000078E000-memory.dmp

Filesize
56KB

Download
memory/4036-71-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/4036-72-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/4036-73-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads