Analysis
-
max time kernel
23s -
max time network
141s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
17-09-2020 13:28
Static task
static1
Behavioral task
behavioral1
Sample
ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe
-
Size
384KB
-
MD5
e6922a68fca90016584ac48fc7722ef8
-
SHA1
a039ae3f86f31a569966a94ad45dbe7e87f118ad
-
SHA256
ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0
-
SHA512
33671f3ce8ae5ce1b2852aeb3a601db82b9b8c83bc682abdebf69fb96d878edeb91a21183f1f456d18dd5ed59c797389de912c627d060866fccb580548c96319
Score
10/10
Malware Config
Signatures
-
Chimera 23 IoCs
Ransomware which infects local and network files, often distributed via Dropbox links.
description flow ioc Process File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe 10 bot.whatismyipaddress.com Process not Found File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\lib\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe -
Chimera Ransomware Loader DLL 2 IoCs
Drops/unpacks executable file which resembles Chimera's Loader.dll.
resource yara_rule behavioral2/memory/3816-0-0x0000000010000000-0x0000000010010000-memory.dmp chimera_loader_dll behavioral2/memory/3816-0-0x0000000010000000-0x0000000010010000-memory.dmp chimera_loader_dll -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 bot.whatismyipaddress.com -
Drops file in Program Files directory 163 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\nn.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\Xusage.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jvm.hprof.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\License.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\README.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\VERSION.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\lib\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jre1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\VERSION.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\readme.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\History.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\YOUR_FILES_ARE_ENCRYPTED.HTML ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3816 ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe"C:\Users\Admin\AppData\Local\Temp\ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0.exe"1⤵
- Chimera
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3816