mafiaware666 | ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9

Analysis

max time kernel
119s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CHROME.msi
Size

288KB
MD5

10cca9ff7368ddfb2301d36fa386669a
SHA1

9ec12af4a97eda16513aa51ec685601c64eec626
SHA256

ba9933fa2ea29f27d73736ecd78d3f598e4786f2207e29fa6c7f42f008d529a9
SHA512

c72938d43e08de87c0328a500810e0c33448110eefb3eaf9569dbb9b91e61e9db4022ca6359e84e2a9b376077d5242948ecdbd2fb433b508a4006463d56d1c85
SSDEEP

3072:81L7cspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8VlhD5:btO9iRQYpgjpjew5DHyGxcqo8f7

Score

10^/10

mafiaware666 discovery ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0031000000023bb6-63.dat	family_mafiaware666
behavioral2/files/0x000a000000023bb9-70.dat	family_mafiaware666
behavioral2/memory/2452-72-0x0000000000AB0000-0x0000000000ABE000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666
Renames multiple (88) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

ICACLS.EXE

pid	Process
396	ICACLS.EXE

Drops desktop.ini file(s) 5 IoCs

Processes:

WindowsFormsApp1_original.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	WindowsFormsApp1_original.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	WindowsFormsApp1_original.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeEXPAND.EXE

description	ioc	Process
File created	C:\Windows\Installer\e577add.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e577add.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{397740B8-798B-4DEB-9E03-ACFFDDD4BF05}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B98.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Executes dropped EXE 1 IoCs

Processes:

WindowsFormsApp1_original.exe

pid	Process
2452	WindowsFormsApp1_original.exe

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid	Process
1172	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000066def5a81497f7c40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000066def5a80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090066def5a8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d66def5a8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066def5a800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid	Process
2216	msiexec.exe
2216	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	Process
Token: SeShutdownPrivilege	4192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4192	msiexec.exe
Token: SeSecurityPrivilege	2216	msiexec.exe
Token: SeCreateTokenPrivilege	4192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4192	msiexec.exe
Token: SeLockMemoryPrivilege	4192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4192	msiexec.exe
Token: SeMachineAccountPrivilege	4192	msiexec.exe
Token: SeTcbPrivilege	4192	msiexec.exe
Token: SeSecurityPrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeLoadDriverPrivilege	4192	msiexec.exe
Token: SeSystemProfilePrivilege	4192	msiexec.exe
Token: SeSystemtimePrivilege	4192	msiexec.exe
Token: SeProfSingleProcessPrivilege	4192	msiexec.exe
Token: SeIncBasePriorityPrivilege	4192	msiexec.exe
Token: SeCreatePagefilePrivilege	4192	msiexec.exe
Token: SeCreatePermanentPrivilege	4192	msiexec.exe
Token: SeBackupPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeShutdownPrivilege	4192	msiexec.exe
Token: SeDebugPrivilege	4192	msiexec.exe
Token: SeAuditPrivilege	4192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4192	msiexec.exe
Token: SeChangeNotifyPrivilege	4192	msiexec.exe
Token: SeRemoteShutdownPrivilege	4192	msiexec.exe
Token: SeUndockPrivilege	4192	msiexec.exe
Token: SeSyncAgentPrivilege	4192	msiexec.exe
Token: SeEnableDelegationPrivilege	4192	msiexec.exe
Token: SeManageVolumePrivilege	4192	msiexec.exe
Token: SeImpersonatePrivilege	4192	msiexec.exe
Token: SeCreateGlobalPrivilege	4192	msiexec.exe
Token: SeBackupPrivilege	4348	vssvc.exe
Token: SeRestorePrivilege	4348	vssvc.exe
Token: SeAuditPrivilege	4348	vssvc.exe
Token: SeBackupPrivilege	2216	msiexec.exe
Token: SeRestorePrivilege	2216	msiexec.exe
Token: SeRestorePrivilege	2216	msiexec.exe
Token: SeTakeOwnershipPrivilege	2216	msiexec.exe
Token: SeRestorePrivilege	2216	msiexec.exe
Token: SeTakeOwnershipPrivilege	2216	msiexec.exe
Token: SeBackupPrivilege	2220	srtasks.exe
Token: SeRestorePrivilege	2220	srtasks.exe
Token: SeSecurityPrivilege	2220	srtasks.exe
Token: SeTakeOwnershipPrivilege	2220	srtasks.exe
Token: SeBackupPrivilege	2220	srtasks.exe
Token: SeRestorePrivilege	2220	srtasks.exe
Token: SeSecurityPrivilege	2220	srtasks.exe
Token: SeTakeOwnershipPrivilege	2220	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid	Process
4192	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	Process	procid_target
PID 2216 wrote to memory of 2220	2216	msiexec.exe	97
PID 2216 wrote to memory of 2220	2216	msiexec.exe	97
PID 2216 wrote to memory of 1172	2216	msiexec.exe	99
PID 2216 wrote to memory of 1172	2216	msiexec.exe	99
PID 2216 wrote to memory of 1172	2216	msiexec.exe	99
PID 1172 wrote to memory of 396	1172	MsiExec.exe	100
PID 1172 wrote to memory of 396	1172	MsiExec.exe	100
PID 1172 wrote to memory of 396	1172	MsiExec.exe	100
PID 1172 wrote to memory of 4748	1172	MsiExec.exe	102
PID 1172 wrote to memory of 4748	1172	MsiExec.exe	102
PID 1172 wrote to memory of 4748	1172	MsiExec.exe	102
PID 1172 wrote to memory of 2452	1172	MsiExec.exe	104
PID 1172 wrote to memory of 2452	1172	MsiExec.exe	104
PID 1172 wrote to memory of 2452	1172	MsiExec.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CHROME.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 051E9437881220CFDFA7C5EBBB693F0C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:396
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\files\WindowsFormsApp1_original.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\files\WindowsFormsApp1_original.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Executes dropped EXE
    PID:2452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\files.cab

Filesize
37KB

MD5
b050ee720b47e099ebeb9fb585ddcd80

SHA1
710b83b1c892872623581cc629a22f7f58672651

SHA256
040c3c2ec3e91c3f6d6b7b895017f08ece1998d0fcae1d40d75312fdf3dae5fc

SHA512
86209153e7be31e5dd638f79dbef639fd8c5642d56b01bc9f8a4370553cf71fcedc82141072739625a7cf397096f0e8cacc774a92796d13ca81b83ed5a89a32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\files\WindowsFormsApp1_original.exe

Filesize
37KB

MD5
fcb4ddf79552dbc16151c4f002e72a81

SHA1
5a6655bf73e42c6e0eb35b58aba5bba91745fb49

SHA256
1e16152df45f8830bc7f5682342fd632dd724cccfd752f9fd1be4cd2c2606179

SHA512
2ef11bf7e3539d812e54a2b6ccd5901fa60e1c873ac19e71e0b1d305090a742f492e2d4ed836b3897f8795335b9181bceb555e2a5c143cff59843ef921e1a4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\msiwrapper.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\msiwrapper.ini

Filesize
1KB

MD5
7c53a195dedb504612d3698b3c28fc5b

SHA1
b45cd6a11f046b75ad08a041b97e338d8aa015f5

SHA256
838c397ead1c0cebe2206614f86c71226d2b63ba5b9bfeac474ca154d31f5dd7

SHA512
3a9f57e041416fabd4cc03c25ab9ffc7d0233510c52e754c2ea9655c0f1fb821be494fcfc01e84b506ead1ae03d077fb56df1dba03d77ef5446a98b455ac885d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e697d471-479e-4972-9964-9e57bfc3688b\msiwrapper.ini

Filesize
1KB

MD5
306a0d87720751112576aee401e99ad4

SHA1
289686ebdb651e136063cb416152066980617e50

SHA256
4ec5f51562f2ac5caa8f55cc198656acc0d1308ab589faaa6a276b1fcbb5a81e

SHA512
f23d9fe581f43a0cc2f8e34cb6c6913c5f31f7ffd89dc325087e13cc4738a4943e2d01223ce0788b168e651f2567e99e0c76509fca08c161b1f487cec8823550

Download Submit
C:\Windows\Installer\MSI7B98.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
b60986e8706d63c017b21a6eacb2dc35

SHA1
33ff49de2c4b21d8da5a630ad207d96e526af2db

SHA256
af117fea88c73c3f9f92addca4ded8f37e36467ffca7159d658b0906cf46f8ca

SHA512
7a7c49fe421bccca0f6f7d0ff2340025977d18084157ddd8646b269528bec1983bd7873fff8bbbd576dd403fddcb4525d003ab00bf52f8eb49d7a69894067d28

Download Submit
\??\Volume{a8f5de66-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5b06f556-9765-41c5-92c0-339d8ebe0609}_OnDiskSnapshotProp

Filesize
6KB

MD5
81fc0d32d5a43bf45249e9ff3657db60

SHA1
f5d4560b1c06c4b62c29031221de298570c0911b

SHA256
a6f5d51d4c59771b671a2a289f33498b1bd789297f6c81a7a55936ce1a3b3350

SHA512
d7ab7ac69c5e02c93b8bd57d0d35dd44d788d5c45d918f69884953c56f7c835b1524d4434a295fdb6bb8963c5427f40c0413c9eaf65ea7915171f776308c260e

Download Submit
memory/2452-72-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download
memory/2452-73-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/2452-74-0x00000000054A0000-0x0000000005532000-memory.dmp

Filesize
584KB

Download
memory/2452-75-0x0000000005660000-0x000000000566A000-memory.dmp

Filesize
40KB

Download