Overview
overview
10Static
static
100811cf7c27...de.exe
windows7-x64
90dd0b31f05...24.exe
windows7-x64
71ad888606f...e0.exe
windows7-x64
31c77a07e45...95.exe
windows7-x64
1023f1c183af...bc.exe
windows7-x64
1038e891599d...90.exe
windows7-x64
103a13e092e9...db.exe
windows7-x64
43b9dabd99d...82.exe
windows7-x64
358fe9776f3...06.exe
windows7-x64
105ab93bd422...11.exe
windows7-x64
36b06c25fc6...43.exe
windows7-x64
106cc8001c9b...07.exe
windows7-x64
173ca5dd6d4...3f.exe
windows7-x64
107b931d48ea...f0.exe
windows7-x64
107d6892645b...0f.exe
windows7-x64
109036aeb570...7e.exe
windows7-x64
39b6289a8bf...2b.exe
windows7-x64
8acf2b76704...a7.exe
windows7-x64
3af2f191f8d...53.exe
windows7-x64
10cc7045d9fe...ab.dll
windows7-x64
10d1a6bd542d...a8.exe
windows7-x64
10efe947e0a8...69.exe
windows7-x64
10f13edd0b86...9f.exe
windows7-x64
10Analysis
-
max time kernel
1200s -
max time network
845s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 09:27
Behavioral task
behavioral1
Sample
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral3
Sample
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral5
Sample
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral19
Sample
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral21
Sample
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral23
Sample
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
Resource
win7-20241010-en
windows7-x64
General
-
Target
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
-
Size
273KB
-
MD5
1d96091dc25660ac8989193299659be7
-
SHA1
bc95772709ad585d528e43de2af29ed0bb628841
-
SHA256
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8
-
SHA512
8c47793a478b0aaf12353ee1f1b2883c0a64eba1511889d33a6782e47f0ac8755dc3b594f2a74820f155243f215f015eb216ef62b6500a8fe9cc0d9cbe0baaa2
-
SSDEEP
3072:U+vMJOW7ySZS3XbhbbzPZEhIUejpSvA+jJwktRCoWvgDcephDZhAzN0V:6GSAHNbbdsjDIcHWvg4efvA
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral21/memory/2120-1-0x0000000000E30000-0x0000000000E7A000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Mafiaware666 family
-
Renames multiple (3494) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0228823.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281008.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXPTOOWS.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00208_.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21297_.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382939.JPG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15171_.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\QUAD.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.ELM d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT632.CNV.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294991.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01394_.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.INF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\VBAOWS10.CHM.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_gu.dll.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216570.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\BLUEPRNT.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287019.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341344.JPG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OSETUPUI.DLL d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00538_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF.clay d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_COL.HXC d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe"C:\Users\Admin\AppData\Local\Temp\d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120