Overview

overview

10

Static

static

Trojan-Ran...38.exe

windows7-x64

10

Trojan-Ran...38.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2022 12:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Chimera.a-1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Chimera.a-1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Chimera.a-1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe"
    1⤵
    • Chimera
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    340B

    MD5

    33456e74df262ee8486c55ce5f452a39

    SHA1

    97c92781cc78da49f1a56df2b6d622b8e53aa2c6

    SHA256

    2c63a0d264eb1595056c2c7c2673a329f3ddef0a2f44877e2ed279068a66b884

    SHA512

    2996c12377edcd4cbf7f0caaef4080fae4bcda6355389e7eb98e59b17df8429d0e887526e74603c2518f242bba2e548286508f6624c963db359f8e6402aff536

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CV8VYY2D.txt
    Filesize

    598B

    MD5

    9c93454b066e32a17748b369e5accb76

    SHA1

    8c7f00339b8e4211f2a333eefac1ae0bc5a48c23

    SHA256

    70e08ceeb7f05a565c64f3dc6c0e7a8341a2bfa62076143fb9635c0de916cf36

    SHA512

    d728923ef9fb429357b1174027cbca71f9546f7d77f76a6a386c4ec350140a990f712e1afc896adf5488422a8f5f1c2732b75632a67f1f8d28a45c937c9e450b

    Download Submit

  • C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    7eb7e07fd8214b0e9eee98e6ddc9c243

    SHA1

    4c667eb17eab8e9aace80682f69be837e671c2bd

    SHA256

    7b57a90660d80fe8aaec4c0de81a44fb10e27960b123d05893caf95b8a6503ca

    SHA512

    7872ff6919dae87cb1fcc0870dba9d00c9ddf2428f479cc3a146dfc0cbdc4edfedf73ee96cb2c01c9e6ecc4542f27a9f9f8327bb0d93b00b2c251b517af4462f

    Download Submit

  • memory/1788-54-0x0000000076201000-0x0000000076203000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1788-55-0x0000000074350000-0x00000000748FB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1788-56-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1788-60-0x0000000000504000-0x000000000051B000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1788-61-0x0000000000470000-0x000000000048A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1788-62-0x0000000074350000-0x00000000748FB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1788-63-0x0000000000504000-0x000000000051B000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1788-64-0x0000000000470000-0x000000000048A000-memory.dmp

    Filesize

    104KB

    Download