Overview

overview

10

Static

static

3

08734899.exe

windows7-x64

10

08734899.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09-06-2023 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08734899.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Renames multiple (2010) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08734899.exe
    "C:\Users\Admin\AppData\Local\Temp\08734899.exe"
    1⤵
    • Chimera
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    b7985f11b8125b9274fde32c298b97cd

    SHA1

    a85667937ae7bde043c9af0aafdff4510b210da3

    SHA256

    8dafef47ea5f6bf20d2ec0250fc067521bfe3e7bb5d344d33fc7f1e955211294

    SHA512

    7456bcfd35dfaac224f5e8dad6ad4c4a10bf333d0c1f3738c9ab7fc26acc88ad5bd7d001bd812b19cd6b97da30b7bcacc2881dfcc23b07e9bd7c64251e5013ca

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    a434b79e2b47ed9577db0f7069c83f29

    SHA1

    7a9ce262a507dcf8ed7d0c019cf63e8aeccc6a1c

    SHA256

    3b6a2c1b462c92df95d9da493e8f114e0c376ad0ee59c3f1c9d4adca29c05178

    SHA512

    4899bb900df226fe9d53640c287f7e2ce535675fb0785da93e354f040b90f4b74c7066f694dd6e232bdc1bcba8f23c9349e9bbbb554d10ae5815e24426f2f4a9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    a7880275e15ae383b617706f2e9172ca

    SHA1

    bacca7e1890af40952fbc3848820aa78879916b1

    SHA256

    c26ac6dd36ef2033688762f3d80e306ae362659667ce5e22898a915c464290c5

    SHA512

    e0f7065fcb872f4426f4a8ee8c79cd15bc02522503b24641b318f5ad1e94c20c21b10d1b88e6fdafd8e0e5e4ee8149e10a397c418ff4bf03426e97d65f475f1b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1b7f63602f7b2cc26216aff71d4c888b

    SHA1

    aae88216432a05b87dcc4d36fe061d6d320b0cb8

    SHA256

    250d1d27b34ceee3344df0078c6e6ae0025c126f4899b974077bbd5fb9ef4c4c

    SHA512

    ecb748dafeccc498f7fe851abd61c3cd407faa7df7572f06a33c2fbe5b00b27ea93b64a5b81323a5066cfc72331d61316c04d6a20780f56eda3ab81043f16adc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b15b90a89ce0f00ccea4664b8ff76f46

    SHA1

    d1f5bb4237f62b2ddd5dd5f52441c00b562a3537

    SHA256

    53b7e5ce06612b165cc12a705bdb2fff9dea3064be5be8acffb368b568470dcb

    SHA512

    1031149086a891d6427ac6fcf29d63dd13291d38953a073f5960aee2bca611acb11abb2bcd8a4439316099b9d58a6daa276c36978f3e55d7c43de2a571cd9baf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    8990ce6b57e07049bc557af9ab568618

    SHA1

    315c44ea35067c098253aeefc572ccdb13e1dfbd

    SHA256

    e64598c9e9b717f0ed634569e29cc695934b57f2cbc922a19d597446efa10cf4

    SHA512

    051a87048fb6f35b1a790c76f4ef9f59965d52d3b941307fc037ef51a7db633d328a30a30734e98a9aa422ee4d3e97f874a5bc3694f8fb7d8dec0420efc7b0ac

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    8cfcf700d8d483d7b907cc9c1f3e833e

    SHA1

    3fe38084839fec4c0ed5e6ab8fee9311e57bd873

    SHA256

    11bbbc14543c4409f263758ff1412d94fd498aea5ed87cd4198c8e5de6c508fa

    SHA512

    2366a70a3d801419843d5f1993b91d435ef795c01b437c1dd8b49cc67acbc14bb8dc9669590012e5a09d9c51b0ce58163c4db518e7f4af05f6e554c14d2c833d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    95889e349e02891b266c152ef57c797d

    SHA1

    e50422e594c1b6b8368bf8ca42952e3aa4ff7f3f

    SHA256

    2355e1cf1b8baaffe4eea4bdda3e3dbb17ea7f3e176b717ad1d4b0b22522ffe1

    SHA512

    0fa536d2c41a2ab2af2859e4960c2903d652c11fb06b48f317ed7fc8cc21f5727dce7790eed058e05e1b29844c5164143a8d24f304abe9b51a2b75646cb48389

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    73581af4fdfa4dd47c924d357f5d4187

    SHA1

    b1645962b07b32a4fca99fd9fada4e368924f2da

    SHA256

    640d791938f46486c1381f7d42c8dfc85eb352fe7e833bafc86b7cbede2d6ec7

    SHA512

    5c5615e662da1dbdbd3edaeeec9a4b18e1f4723648c68a4dc1b91edc1327edcc6c1865c0883b5890f7caf78e3b14aeb9975b37abee9a16e2adb39dd0d24fae02

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    325ed75c32f5eb2c2513eebe6ce911e5

    SHA1

    55af2de77ef01b430ed1fd46ed630ca4d6fd568a

    SHA256

    a38633e1a827c62f7a89715ad982d2d5fc36d5816299031955e1dfa81905e791

    SHA512

    27f51d64b33c38a5191218c47c3e1df9ed4dfe3b61b4756477ce71959091bb26fc3d0692c66fd38b25b30999a83e63987056385ea597ece80aba66c7ab9bae66

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    805a2bd2b49001cae1a2cd16bf55c8cc

    SHA1

    5b52e22b5b328f15ad33c180251454754ec1d410

    SHA256

    ba82ec5e337289ca420fb24006bdeef00ca54722732fa285592c6ebfde1fc940

    SHA512

    d9f71a7375557e81957eada8e9ba81a6f4786bbab71f45704bb5d4cc193c12b59dcd5ef822e184ab8ac7c72abd03236984c2dc71a722f900b8257e958af387de

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    80b94a5ef41214e407917d04aa63912a

    SHA1

    5a97b81f64b738adc1d03cfa37e1e6ec1095c895

    SHA256

    7897e1b38d31f6d87e54d495a44c40fc0e14fc9ca902bd074278f2432ffcdca5

    SHA512

    9774b4b7d1e073305fcd498109821469bcbcfba8eed8ee56363384544d6d48a6e10bb149663e8ad498fb1d7ab8246ceadd9ad24b054c4a00bb19b996c74d463c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TF0W5LQL\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabB5AC.tmp
    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarBA54.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D99EOK25.txt
    Filesize

    605B

    MD5

    87ee8fc902d5b53556f12561c1c64bbb

    SHA1

    1e5ecfbfe09cb1995ad4c475db804b30e5c78686

    SHA256

    1d0deb65e7e6f31e3ce4f5c3b9b38fc2a26df07800649636012ac2832d7938e1

    SHA512

    236b0b9e8fcab27642323c765f0835cd3522ebbab0909268a07f712a63f7cddefc610a6031340df5c37e2ef12f8f308a3de3d35ced76f45aabd5221cfaf87728

    Download Submit

  • C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    b7985f11b8125b9274fde32c298b97cd

    SHA1

    a85667937ae7bde043c9af0aafdff4510b210da3

    SHA256

    8dafef47ea5f6bf20d2ec0250fc067521bfe3e7bb5d344d33fc7f1e955211294

    SHA512

    7456bcfd35dfaac224f5e8dad6ad4c4a10bf333d0c1f3738c9ab7fc26acc88ad5bd7d001bd812b19cd6b97da30b7bcacc2881dfcc23b07e9bd7c64251e5013ca

    Download Submit

  • memory/1736-61-0x0000000000560000-0x000000000057A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1736-54-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1736-59-0x0000000002050000-0x0000000002090000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1736-60-0x0000000000560000-0x000000000057A000-memory.dmp

    Filesize

    104KB

    Download