Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 13:21
Behavioral task
behavioral1
Sample
CHROME.msi
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
CHROME.msi
Resource
win10v2004-20240419-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
CHROME.msi
-
Size
288KB
-
MD5
10cca9ff7368ddfb2301d36fa386669a
-
SHA1
9ec12af4a97eda16513aa51ec685601c64eec626
-
SHA256
ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
-
SHA512
c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
-
SSDEEP
3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7
Score
10/10
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 3 IoCs
Processes:
resource yara_rule behavioral1/files/0x00050000000186a0-59.dat family_mafiaware666 behavioral1/files/0x0006000000018b15-66.dat family_mafiaware666 behavioral1/memory/1208-72-0x0000000000C00000-0x0000000000C0E000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Renames multiple (84) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 3 IoCs
Processes:
WindowsFormsApp1_original.exedescription ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini WindowsFormsApp1_original.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WindowsFormsApp1_original.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 10 IoCs
Processes:
msiexec.exeEXPAND.EXEDrvInst.exedescription ioc Process File created C:\Windows\Installer\f7709f1.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f7709f0.msi msiexec.exe File opened for modification C:\Windows\Installer\f7709f0.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSID98.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
WindowsFormsApp1_original.exepid Process 1208 WindowsFormsApp1_original.exe -
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepid Process 2420 MsiExec.exe 2420 MsiExec.exe 2420 MsiExec.exe 2420 MsiExec.exe 2420 MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 2908 msiexec.exe 2908 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid Process Token: SeShutdownPrivilege 2956 msiexec.exe Token: SeIncreaseQuotaPrivilege 2956 msiexec.exe Token: SeRestorePrivilege 2908 msiexec.exe Token: SeTakeOwnershipPrivilege 2908 msiexec.exe Token: SeSecurityPrivilege 2908 msiexec.exe Token: SeCreateTokenPrivilege 2956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2956 msiexec.exe Token: SeLockMemoryPrivilege 2956 msiexec.exe Token: SeIncreaseQuotaPrivilege 2956 msiexec.exe Token: SeMachineAccountPrivilege 2956 msiexec.exe Token: SeTcbPrivilege 2956 msiexec.exe Token: SeSecurityPrivilege 2956 msiexec.exe Token: SeTakeOwnershipPrivilege 2956 msiexec.exe Token: SeLoadDriverPrivilege 2956 msiexec.exe Token: SeSystemProfilePrivilege 2956 msiexec.exe Token: SeSystemtimePrivilege 2956 msiexec.exe Token: SeProfSingleProcessPrivilege 2956 msiexec.exe Token: SeIncBasePriorityPrivilege 2956 msiexec.exe Token: SeCreatePagefilePrivilege 2956 msiexec.exe Token: SeCreatePermanentPrivilege 2956 msiexec.exe Token: SeBackupPrivilege 2956 msiexec.exe Token: SeRestorePrivilege 2956 msiexec.exe Token: SeShutdownPrivilege 2956 msiexec.exe Token: SeDebugPrivilege 2956 msiexec.exe Token: SeAuditPrivilege 2956 msiexec.exe Token: SeSystemEnvironmentPrivilege 2956 msiexec.exe Token: SeChangeNotifyPrivilege 2956 msiexec.exe Token: SeRemoteShutdownPrivilege 2956 msiexec.exe Token: SeUndockPrivilege 2956 msiexec.exe Token: SeSyncAgentPrivilege 2956 msiexec.exe Token: SeEnableDelegationPrivilege 2956 msiexec.exe Token: SeManageVolumePrivilege 2956 msiexec.exe Token: SeImpersonatePrivilege 2956 msiexec.exe Token: SeCreateGlobalPrivilege 2956 msiexec.exe Token: SeBackupPrivilege 2852 vssvc.exe Token: SeRestorePrivilege 2852 vssvc.exe Token: SeAuditPrivilege 2852 vssvc.exe Token: SeBackupPrivilege 2908 msiexec.exe Token: SeRestorePrivilege 2908 msiexec.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2960 DrvInst.exe Token: SeLoadDriverPrivilege 2960 DrvInst.exe Token: SeLoadDriverPrivilege 2960 DrvInst.exe Token: SeLoadDriverPrivilege 2960 DrvInst.exe Token: SeRestorePrivilege 2908 msiexec.exe Token: SeTakeOwnershipPrivilege 2908 msiexec.exe Token: SeRestorePrivilege 2908 msiexec.exe Token: SeTakeOwnershipPrivilege 2908 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid Process 2956 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid Process procid_target PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2908 wrote to memory of 2420 2908 msiexec.exe 34 PID 2420 wrote to memory of 2152 2420 MsiExec.exe 35 PID 2420 wrote to memory of 2152 2420 MsiExec.exe 35 PID 2420 wrote to memory of 2152 2420 MsiExec.exe 35 PID 2420 wrote to memory of 2152 2420 MsiExec.exe 35 PID 2420 wrote to memory of 1388 2420 MsiExec.exe 37 PID 2420 wrote to memory of 1388 2420 MsiExec.exe 37 PID 2420 wrote to memory of 1388 2420 MsiExec.exe 37 PID 2420 wrote to memory of 1388 2420 MsiExec.exe 37 PID 2420 wrote to memory of 1208 2420 MsiExec.exe 39 PID 2420 wrote to memory of 1208 2420 MsiExec.exe 39 PID 2420 wrote to memory of 1208 2420 MsiExec.exe 39 PID 2420 wrote to memory of 1208 2420 MsiExec.exe 39 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CHROME.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2956
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89A5FCA424F30EF81C535763C417D0DC2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-eff174c5-cac1-4885-8f85-82cc2d202f4d\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2152
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\MW-eff174c5-cac1-4885-8f85-82cc2d202f4d\files\WindowsFormsApp1_original.exe"C:\Users\Admin\AppData\Local\Temp\MW-eff174c5-cac1-4885-8f85-82cc2d202f4d\files\WindowsFormsApp1_original.exe"3⤵
- Drops desktop.ini file(s)
- Executes dropped EXE
PID:1208
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C4" "00000000000003C0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5b050ee720b47e099ebeb9fb585ddcd80
SHA1710b83b1c892872623581cc629a22f7f58672651
SHA256040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc
SHA51286209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e
-
C:\Users\Admin\AppData\Local\Temp\MW-eff174c5-cac1-4885-8f85-82cc2d202f4d\files\WindowsFormsApp1_original.exe
Filesize37KB
MD5fcb4ddf79552dbc16151c4f002e72a81
SHA15a6655bf73e42c6e0eb35b58aba5bba91745fb49
SHA2561e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179
SHA5122ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3
-
Filesize
358B
MD5d66e00be997607f84b648a86634c4679
SHA1cb7e11854837aedc758b970e6f6a8d37c951b9dc
SHA2566436b15b40407223ca43eb4bd64d2b980adbaf17fcc2b1f8f21a9932d613c3b8
SHA5127b223117a6516b35aff6e563e46975f687044657e50d1d3c7f60df3b15668b9e047085aa92c7ee0b24df4762db33a2f842fcfb322d5d13cbe37cdce30fe1dd7e
-
Filesize
1KB
MD568851f9d7fbd836a9ef707d82eec04e3
SHA1137b5afe4a9e81a26601a89a8d5301014b8cd195
SHA2567599057b37d5bacaa3402e8d5245fca9f14f3ef30165ed931894144cc192d660
SHA512ae0af03d6955b85ab38e5f7bc7b1693ee9a496ce3cea8c115e3c65a5f8c4a4baa28940cdc5d07c0bc8167d4c0ee47d34373d339cbd5aff50c57650b13ea1e947
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108