mafiaware666 | 096ef1633a1e4b28ea46406a6324998b5f4dc59f6596c3dfbe7d6ee403186733

General

Target

WindowsFormsApp1.exe
Size

1.3MB
MD5

3dce90e3a6daa8810d0dec78fd960e7d
SHA1

d44f4aa742092f33ec60264e15f09fd127a7bb87
SHA256

096ef1633a1e4b28ea46406a6324998b5f4dc59f6596c3dfbe7d6ee403186733
SHA512

bd68ff08882a61bbc4d51ca4ae2e055e20db853c79f6ea0dd5867e673af38785ddc4f992c1891ecf6d658bba89556b23797d708f3d7ca1da1eb4332f9a2ea84c
SSDEEP

24576:RTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:RT7RseZDT2tSbvQsIbe8YVjPH81

Score

10^/10

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/3112-1-0x0000000000C90000-0x0000000000DE2000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666
Mafiaware666 family
mafiaware666
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	WindowsFormsApp1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsFormsApp1.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\.jcrypt\ = "jcrypt_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\ીﹱǞ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\.jcrypt	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\ીﹱǞ\ = "jcrypt_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\\ = "jcrypt_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\쁗塂찀蠀񙟸\ = "jcrypt_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\쁗塂찀蠀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\jcrypt_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000_Classes\	OpenWith.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
1212	NOTEPAD.EXE
4828	NOTEPAD.EXE
4704	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3924	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe
3924	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1212	3924	OpenWith.exe	95
PID 3924 wrote to memory of 1212	3924	OpenWith.exe	95

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:3112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\AddExit.dib.jcrypt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1212

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\93f562c174d34873a51cd060fc34e7ec /t 2812 /p 1212
1⤵
PID:4332

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\AddExit.dib.jcrypt
1⤵
- Opens file in notepad (likely ransom note)
PID:4828

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\AddExit.dib.jcrypt
1⤵
- Opens file in notepad (likely ransom note)
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pictures\AddExit.dib.jcrypt

Filesize
1.1MB

MD5
ddd7eb9e9671bac80b000604bb183fd3

SHA1
3a24b0891f4f61bd516a62139945f538265f1e2a

SHA256
a2c90a9fb0f226e452bc576c8c30550a98e15352371ecd1a7ec284cd0a112098

SHA512
0d7a3a7832176c92adb286702e63b550019fd050563089eb803e71706419c74e29436aee9bb9139b4d75c2a41c01142d3b57e41dbacd0f5018a121c53028d179

Download Submit
memory/3112-0-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/3112-1-0x0000000000C90000-0x0000000000DE2000-memory.dmp

Filesize
1.3MB

Download
memory/3112-2-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download
memory/3112-3-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/3112-4-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3112-5-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/3112-6-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3112-27-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/3112-30-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3112-34-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/3112-89-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing