Overview
overview
10Static
static
100811cf7c27...de.exe
windows7-x64
90dd0b31f05...24.exe
windows7-x64
71ad888606f...e0.exe
windows7-x64
31c77a07e45...95.exe
windows7-x64
1023f1c183af...bc.exe
windows7-x64
1038e891599d...90.exe
windows7-x64
103a13e092e9...db.exe
windows7-x64
43b9dabd99d...82.exe
windows7-x64
358fe9776f3...06.exe
windows7-x64
105ab93bd422...11.exe
windows7-x64
36b06c25fc6...43.exe
windows7-x64
106cc8001c9b...07.exe
windows7-x64
173ca5dd6d4...3f.exe
windows7-x64
107b931d48ea...f0.exe
windows7-x64
107d6892645b...0f.exe
windows7-x64
109036aeb570...7e.exe
windows7-x64
39b6289a8bf...2b.exe
windows7-x64
8acf2b76704...a7.exe
windows7-x64
3af2f191f8d...53.exe
windows7-x64
10cc7045d9fe...ab.dll
windows7-x64
10d1a6bd542d...a8.exe
windows7-x64
10efe947e0a8...69.exe
windows7-x64
10f13edd0b86...9f.exe
windows7-x64
10Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 09:21
Behavioral task
behavioral1
Sample
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral3
Sample
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral4
Sample
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral5
Sample
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral13
Sample
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral17
Sample
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral21
Sample
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral22
Sample
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
-
Size
273KB
-
MD5
1d96091dc25660ac8989193299659be7
-
SHA1
bc95772709ad585d528e43de2af29ed0bb628841
-
SHA256
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8
-
SHA512
8c47793a478b0aaf12353ee1f1b2883c0a64eba1511889d33a6782e47f0ac8755dc3b594f2a74820f155243f215f015eb216ef62b6500a8fe9cc0d9cbe0baaa2
-
SSDEEP
3072:U+vMJOW7ySZS3XbhbbzPZEhIUejpSvA+jJwktRCoWvgDcephDZhAzN0V:6GSAHNbbdsjDIcHWvg4efvA
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral21/memory/1372-1-0x0000000000E30000-0x0000000000E7A000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Mafiaware666 family
-
Renames multiple (422) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pkeyconfig-office.xrm-ms d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\CANYON.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\REFINED.ELM.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPHPROXY.DLL.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\THMBNAIL.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\BLUECALM.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\BREEZE.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\THMBNAIL.PNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PREVIEW.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FNT.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\PREVIEW.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.INF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\REFINED.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OFFREL.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.TXT d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\MTEXTRA.TTF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\PREVIEW.GIF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\PREVIEW.GIF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OFFREL.DLL.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.INF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\THMBNAIL.PNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUISet.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\REFINED.INF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\BREEZE.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\THMBNAIL.PNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\PREVIEW.GIF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\THMBNAIL.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\ARCTIC.ELM.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe"C:\Users\Admin\AppData\Local\Temp\d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1372