Analysis
- max time kernel
10s - max time network
157s - platform
windows7_x64 - resource
win7 - submitted
17/09/2020, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
- Size 232KB
- Sample200917-eaa2a96xna
- SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
- MD5 60fabd1a2509b59831876d5e2aa71a6b
- SHA1 8b91f3c4f721cb04cc4974fc91056f397ae78faa
- SHA512 3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Chimera 23 IoCs
Ransomware which infects local and network files, often distributed via Dropbox links.
description flow ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\lib\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe 6 bot.whatismyipaddress.com Process not Found File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Microsoft Office\Office14\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe - Chimera Ransomware Loader DLL 2 IoCs
Drops/unpacks executable file which resembles Chimera's Loader.dll.
resource yara_rule behavioral1/memory/1124-0-0x0000000010000000-0x0000000010010000-memory.dmp chimera_loader_dll behavioral1/memory/1124-0-0x0000000010000000-0x0000000010010000-memory.dmp chimera_loader_dll - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 bot.whatismyipaddress.com - Drops file in Program Files directory 170 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\lib\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\License.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Microsoft Office\Office14\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\History.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jre7\README.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\PingDisable.ppt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\readme.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jre7\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1124 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe"C:\Users\Admin\AppData\Local\Temp\1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe"1⤵
- Chimera
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1124